{ "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json", "schema_version": "0.3", "version": "0.3", "status": "draft", "conceptual": true, "not_for_clinical_use": true, "max_autonomy": 2, "missions": [ "leo", "commercial", "moon", "mars" ], "updated": "2026-10-21", "review": { "state": "reviewed-ai-assisted", "requested": "2026-10-21", "human_clinician_review": false, "text": "AI-assisted clinical and source review by the Medical Research Assistant (batch 12 review, Oct 21, 2026, then verification passes). The verification pass (Oct 21, 2026) found the v0.3 text clinically clean and R1 to R5 applied; publication of this exact content (contentSha cc3ce1c9…7ea6c) was decided by the foundation owner (Oct 21, 2026) under PHARM change control. No named human clinician has reviewed it. Not for clinical use.", "reviewed": "2026-10-21", "verified_version": "0.3", "verified": "2026-10-21" }, "fixed_rules": { "flight_surgeon_is_medical_authority": true, "cmo_acts_under_delegated_care": true, "human_starts_and_restarts_robot": true, "robot_never_diagnoses": true, "no_drug_or_fluid_advice_by_robot": true, "safe_state_on_fault_or_no_response": true, "lost_link_pause_then_cmo_decides": true }, "robot_lockouts": { "diagnosis": true, "drug_or_fluid_advice": true, "starting_stopping_or_adjusting_oxygen_or_any_medicine": true, "self_start_or_self_restart": true, "changing_own_protocol_thresholds_or_limits": true, "handing_over_a_mismatched_item_as_verified": true }, "id": "RMP-PHARM-004", "slug": "rmp-pharm-004", "title": "Controlled-medicine count with a crewmember: a blind two-person count, comparison with the inventory record and a private discrepancy flag (no hand-over)", "category": "pharm", "tier": 3, "rung_note": "Max rung 2: on the CMO's command or an accepted schedule prompt, the robot logs a count that two humans make (the CMO and a second crewmember as witness), scans labels without touching any pack, compares the counts with the RMP-PHARM-001 inventory record and flags any discrepancy privately. The robot is never the second counter, never opens the controlled store and never holds, takes or hands over any medicine. The RMP-PHARM-001 rules apply unchanged.", "result_language": { "use": [ "COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review.", "MISMATCH: . NOT VERIFIED. Quarantined.", "CANNOT VERIFY: . NOT VERIFIED. Quarantined.", "count as stated by ", "printed expiry: ", "record correction logged" ], "never": [ "normal", "no problem found", "all clear", "negative", "any diagnosis or cause", "verified safe", "safe to take", "OK to give", "MATCH (on its own, without \"to the inventory record\")", "missing", "stolen", "taken by", "diverted", "in date", "usable", "fine to use", "safe", "mild", "minor" ] }, "scope": { "summary": "On the CMO's command, or when the CMO accepts the on-screen prompt at the count times the pharmacy lead and flight surgeon set (for example each crew handover), the CMO opens the controlled-medicine store with a second crewmember present as witness. Each of them counts each item without seeing the record count (a blind count) and states it; the robot scans each label as it is shown, logs both counts word for word, and only then compares them with each other and with the RMP-PHARM-001 inventory record field by field. Anything that does not match is quarantined by default exactly as in RMP-PHARM-001 and flagged privately to the flight surgeon and the pharmacy lead. The robot never names or suggests who might be responsible.", "why": "Hospital guidance has two authorized health care workers count controlled substances held outside automated cabinets at each shift change, and identifies and investigates discrepancies promptly (ASHP 2022, used by analogy). NASA tracks the location and quantity of medicines (V2 7059), and long missions make inventory control more important (OCHMO-MTB-012). The robot is not a second counter: two humans count, and the robot logs, compares and flags. The RMP-PHARM-001 rule applies unchanged: a mismatch is quarantined by default, handed over only on the CMO's explicit two-step request inside RMP-PHARM-001, logged as an override and flagged to the flight surgeon. The blind count, the count times and the private flag are design judgment. Open question for review: whether the count needs a second trained CMO as witness, or any crewmember.", "covers": [ "Scheduled and on-command two-person counts of the controlled-medicine store", "Comparison with the RMP-PHARM-001 inventory record (medicine, strength, form, quantity, lot, location, printed expiry)", "Quarantine of anything that does not match, as in RMP-PHARM-001", "Other medicine inventory: RMP-PHARM-002; logging a dose given: RMP-PHARM-003" ], "locked_out": [ "Diagnosis or naming a cause", "Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen", "Touching the crewmember", "Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)", "Acting as the second counter or witness", "Opening the controlled store, or holding its key or code", "Holding, taking, moving or handing over any medicine (the CMO moves items into quarantine)", "Showing the record count, or either count, before both counts are entered", "Saying or suggesting who took an item, or that anything was stolen or diverted", "Changing an RMP-PHARM-001 order (never)", "Changing the inventory record outside the two-step record correction the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact); a correction is never decided by the CMO alone or by the robot, fixes the record only, and never takes an item out of quarantine", "Saying a medicine is in date, usable or fine to use", "Dose-interval cues of any kind (the robot never says when a medicine is due)" ], "related": [ "RMP-PHARM-001", "RMP-PHARM-002", "RMP-PHARM-003", "RMP-BEH-002" ] }, "roles": { "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.", "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.", "others": [ "Second trained CMO: receives every alert and flag and takes over if the CMO is unavailable", "Witness: a second crewmember who counts independently", "Pharmacy lead (ground): investigates discrepancies and decides record corrections" ], "robot_may": [ "Prompt the CMO at the count times set", "Scan labels as they are shown, without touching any pack", "Log both counts word for word", "Compare the counts with the inventory record", "Flag discrepancies privately to the flight surgeon and pharmacy lead" ], "robot_may_not": [ "Count as the second person or witness", "Open the store or hold its key or code", "Hold, take or hand over any medicine", "Say who might be responsible for a discrepancy", "Say when a medicine is due", "Change an RMP-PHARM-001 order (never)", "Start without a human command or an accepted schedule prompt" ], "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)" }, "preconditions": [ { "id": "PRE-1", "text": "The CMO started the count by command or accepted the scheduled prompt on screen, and a second crewmember is present as witness; no URGENT alert, emergency protocol or cabin alarm is active.", "check": "human_start == true", "refs": [ "V2 10174" ] }, { "id": "PRE-2", "text": "Robot self-test passed; kit stowage locations known.", "refs": [ "V2 10161", "V2 7059" ] }, { "id": "PRE-3", "text": "Robot and supplies restrained when not moving.", "refs": [ "V2 7046" ] }, { "id": "PRE-4", "text": "Link status known. The crew never wait for the robot before acting.", "check": "link_state in [live, delayed, down]" } ], "consent": { "standard": "The count involves no crewmember's body; the CMO and the witness agree to their names and counts being logged.", "emergency": "A count stops at once for any emergency; the store stays open to the crew for emergency use.", "withdrawal": "The CMO can stop a count at any time; items not counted are listed as \"not counted\"." }, "inputs": [ { "id": "IN-1", "name": "Inventory record for the controlled store (medicine, strength, form, quantity, lot, printed expiry, location)", "source": "RMP-PHARM-001 inventory record (local copy when the link is down)", "required": true, "if_missing": "CANNOT VERIFY for the store; the count is logged as stated only." }, { "id": "IN-2", "name": "Count of each item as stated by the CMO, and by the witness", "source": "CMO and witness", "required": true, "if_missing": "CANNOT VERIFY: count not stated; quarantined." }, { "id": "IN-3", "name": "Barcode and label of each pack, as shown", "source": "Robot scanner", "required": true, "if_missing": "CANNOT VERIFY: unreadable label; quarantined." }, { "id": "IN-4", "name": "Count times, set by the pharmacy lead and flight surgeon", "source": "Pharmacy lead", "required": false, "if_missing": "Counts on command only." }, { "id": "IN-5", "name": "Link status and delay", "source": "Communications system", "required": true, "if_missing": "Treat as link down; work from the local record copy." } ], "steps": [ { "id": "S1", "actor": "robot", "rung": 2, "action": "Tell the flight surgeon, the CMO and the pharmacy lead that a controlled-medicine count has started, with who is counting (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember.", "success": "Notice logged.", "refs": [ "V1 3006", "V2 10174" ], "action_type": "alert" }, { "id": "S2", "actor": "crew", "action": "The CMO opens the controlled store with the witness present. The CMO and the witness each count each item without seeing the record count, and enter their count privately on their own screen; no count is spoken, and neither count nor the record count is shown until both are entered; the CMO holds up each pack label to the scanner.", "success": "Both counts stated for each item.", "refs": [ "V2 7059" ] }, { "id": "S3", "actor": "robot", "rung": 2, "action": "Scan each label as the CMO shows it, without touching any pack, and log each count as entered, with who entered it. Show no count and no record count for an item until both counts for it are entered.", "success": "Labels scanned; both counts logged.", "refs": [ "V2 7059" ], "action_type": "scan-compare" }, { "id": "S4", "actor": "robot", "rung": 2, "action": "Compare the two counts with each other and with the inventory record field by field (medicine, strength, form, quantity, lot, printed expiry, location). Show \"COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review.\" only when both counts and every field match; otherwise show MISMATCH or CANNOT VERIFY with the fields named. Show the date as \"printed expiry: \".", "success": "Each item shown with its result.", "refs": [ "V2 7059" ], "action_type": "scan-compare" }, { "id": "S5", "actor": "crew", "action": "For each MISMATCH or CANNOT VERIFY, the CMO, with the witness present, seals the item in a labelled NOT VERIFIED bag in the quarantine section of the controlled store, then closes and reseals the store and states the new seal number.", "success": "Items quarantined; store resealed.", "refs": [ "V2 7059" ] }, { "id": "S6", "actor": "robot", "rung": 2, "action": "Record each quarantine and the new seal number as stated, and update the inventory record status to NOT VERIFIED for those items. The robot never holds, takes or hands over anything.", "success": "Record updated.", "refs": [ "V2 7059" ], "action_type": "log" }, { "id": "S7", "actor": "robot", "rung": 2, "action": "After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.", "success": "Robot at rest in the module until a human releases it; alert acknowledged or escalated.", "refs": [ "V2 10173", "V1 3006" ], "action_type": "stay" }, { "id": "S8", "actor": "ground", "action": "The pharmacy lead and flight surgeon investigate each discrepancy, and the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact) any record correction. A correction is never decided by the CMO alone or by the robot.", "success": "Decisions logged.", "refs": [ "V1 3004" ] }, { "id": "S9", "actor": "robot", "rung": 2, "action": "Send one private report to the flight surgeon and the pharmacy lead (and the CMO): items counted, both counts, each result, quarantined items and the seal number; it names only the counters, never anyone as responsible.", "success": "Report delivered or queued; acknowledged.", "refs": [ "V1 6003", "V1 7003" ], "action_type": "send" } ], "decisions": [ { "id": "D1", "after": "S1", "decided_by": "robot", "question": "Is a second crewmember present to count as witness?", "branches": [ { "if": "Yes", "then": "Continue." }, { "if": "No", "then": "The count does not start: log \"CANNOT VERIFY: no witness\" and tell the CMO; the robot is never the second counter. No hand-over.", "handoff": "none" } ] }, { "id": "D2", "after": "S3", "decided_by": "robot", "question": "Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?", "branches": [ { "if": "Yes", "then": "Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember." }, { "if": "No", "then": "Continue." } ] }, { "id": "D3", "after": "S4", "decided_by": "robot", "question": "Did both counts and every inventory field match the record for this item?", "branches": [ { "if": "Yes", "then": "Record \"COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review.\" and continue to the next item." }, { "if": "No, or a check could not be done", "then": "HARD STOP for that item. Show MISMATCH or CANNOT VERIFY with the fields named (for example the two counts differ, a count differs from the record, the lot or location differs, a tamper seal is broken, or a label is unreadable). The item is quarantined by default, as in RMP-PHARM-001: the CMO, with the witness present, seals it in a labelled NOT VERIFIED bag in the quarantine section of the controlled store, and the robot records it. No hand-over. An item leaves quarantine only inside RMP-PHARM-001, on a real order, through its unchanged two-step CMO override (logged as an override and flagged to the flight surgeon). A record correction fixes the record only and never takes an item out of quarantine.", "handoff": "none" }, { "if": "A record correction that the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact), never the CMO alone and never the robot, entered in two steps: by the pharmacy lead from the ground, or, with the link down, by the CMO and the witness together (two people, neither stating for the other), flagged, and reviewed by the pharmacy lead at the next contact", "then": "Record correction only. No hand-over: the robot reads back the fields to change, updates the record when the second step confirms it, flags the correction to the flight surgeon at once (queued if the link is down), and logs a recount by the CMO and the witness against the corrected record. Any use of the item goes only through RMP-PHARM-001 on a real order. The correction fixes the record only: the item stays quarantined.", "handoff": "none" }, { "if": "Anyone asks the robot for a quarantined item", "then": "No hand-over in this protocol. The robot says that a quarantined item leaves quarantine only inside RMP-PHARM-001, on a real order, through its two-step CMO override, and logs the request.", "handoff": "none" } ] }, { "id": "D4", "after": "S9", "decided_by": "robot", "question": "Did the flight surgeon or the CMO acknowledge the report within minutes?", "branches": [ { "if": "Yes", "then": "Log the acknowledgement." }, { "if": "No response", "then": "URGENT: log \"no response\" (never \"declined\"); the report goes to the second trained CMO, or the next named crewmember, who checks on the CMO in person." } ] }, { "id": "D5", "after": "S8", "decided_by": "ground", "question": "What happens to each quarantined item, and is a record correction needed?", "branches": [ { "if": "Link live", "then": "Flight surgeon decides; robot logs." }, { "if": "Link down or delay too long", "then": "The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact." } ] } ], "verification": { "kind": "controlled-count", "fields": [ "medicine", "strength", "dose_form", "quantity", "lot", "location", "expiry", "record_flags" ], "recipient_check": "No hand-over in this protocol. Any use of a medicine runs through RMP-PHARM-001, which confirms the recipient.", "match_label": "COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review.", "on_mismatch": { "hard_stop": true, "default": "Sealed by the CMO, with the witness present, in a labeled NOT VERIFIED bag in the quarantine section of the controlled store; the robot records it. No hand-over in this protocol.", "unprompted_handoff": false, "handoff_to_anyone_but_cmo": false, "logged_as": "record-correction", "cmo_override": { "allowed": false, "who": "CMO", "request": "Two-step record correction only, never a hand-over and never a release from quarantine: the record error the pharmacy lead decided is stated, then confirmed in a separate step; the correction fixes the record only.", "steps": [ "The pharmacy lead states the correction from the ground (with the link down, the CMO and the witness state it together, neither stating for the other); the robot reads back the fields to change.", "The correction is confirmed in a separate, deliberate step; the robot updates the record and rescans the item." ], "log": [ "timestamp", "cmo_identity", "reason", "mismatched_fields", "item_barcode", "pharmacy_lead_decision", "witness_identity", "link_state" ], "notify_flight_surgeon": "Every record correction is flagged to the flight surgeon and the pharmacy lead at once; a correction entered with the link down is queued, flagged and reviewed by the pharmacy lead at the next contact.", "statement": "NOT VERIFIED - MISMATCH: . Record correction only; no override.", "decided": "Same rule as RMP-PHARM-001 and RMP-PHARM-002, applied unchanged: no hand-over in a count protocol; the RMP-PHARM-001 mismatch rule (quarantine by default, hand-over only on the CMO's explicit two-step request inside RMP-PHARM-001, logged as an override and flagged to the flight surgeon) stays as it is. A record correction never takes an item out of quarantine (batch 12 review R2)." } }, "scan_failure": "No match; the item is quarantined. The item leaves quarantine only inside RMP-PHARM-001 on a real order; a record correction fixes the record only. The robot never scans a substitute label or another package (proxy scan)." }, "stop_rules": [ { "id": "X1", "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent", "action": "Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running.", "level": "stop", "refs": [ "V2 10165" ] }, { "id": "X2", "trigger": "Any crewmember presses stop or takes over control", "action": "Protective stop; robot holds its stopped position; only a human may restart it.", "level": "safe-state", "refs": [ "V2 10165", "V2 10168", "V2 10174" ] }, { "id": "X3", "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached", "action": "Protective stop and hand control to the CMO; log the fault.", "level": "safe-state", "refs": [ "V2 10172", "V2 10168" ] }, { "id": "X4", "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)", "action": "Robot stays stopped; the next named crewmember is called.", "level": "safe-state", "refs": [ "V2 10173", "V2 7045" ] }, { "id": "X5", "trigger": "Loss of link, or delay longer than the limit for live guidance", "action": "Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's route (it never pauses in one), and tells the CMO. This pauses robot movement only: crew access to medicine stores and all crew care continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation.", "level": "pause", "refs": [ "V2 10172", "V2 10173" ] }, { "id": "X6", "trigger": "An URGENT alert is not acknowledged within the set time", "action": "Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own.", "level": "urgent", "refs": [ "V1 3006", "V2 10173" ] }, { "id": "X7", "trigger": "The crewmember stops responding, or seems confused or drowsy, at any point", "action": "URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person.", "level": "urgent" }, { "id": "X8", "trigger": "A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice", "action": "Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.", "level": "stop" }, { "id": "X9", "trigger": "Any URGENT alert, emergency protocol or cabin alarm", "action": "The count ends at once; the store stays open to the crew for emergency use and is resealed as the CMO directs.", "level": "urgent", "refs": [ "V2 10173" ] }, { "id": "X10", "trigger": "Someone needs the space or route the robot is in", "action": "Robot moves clear at once without contact and holds; it never pauses in a hatch route.", "level": "safe-state", "refs": [ "V2 10172" ] } ], "red_flags": [ { "id": "RF1", "sign": "A crewmember needs care during the count (design judgment)", "threshold": "any", "action": "URGENT alert; the count stops and the store stays within the crew's reach" }, { "id": "RF2", "sign": "The two counts differ, or a count is lower than the record", "threshold": "any", "action": "Flag privately to the flight surgeon and pharmacy lead at once; the robot never says who took it", "source": "ashp2022" }, { "id": "RF3", "sign": "A broken or missing tamper seal on the store or a pack, as seen on the label scan or stated (design judgment)", "threshold": "any", "action": "Flag privately to the flight surgeon and pharmacy lead at once" }, { "id": "RF4", "sign": "An emergency controlled medicine (for example in the trauma or pain kit) missing or past its printed expiry", "threshold": "any", "action": "Flag at once to the CMO, flight surgeon and pharmacy lead; the robot names the item, never a substitute", "source": "tb006" }, { "id": "RF5", "sign": "A crewmember says they took a controlled medicine that was not ordered, or more than ordered (design judgment)", "threshold": "any", "action": "URGENT alert to the CMO and flight surgeon with the words as stated; the CMO checks in person; the robot does not comment on the amount" }, { "id": "RF6", "sign": "Talk of self-harm or suicide, or of not wanting to be alive", "threshold": "any (if not sure, treat as yes)", "action": "URGENT private alert to the flight surgeon now; the CMO if the link is down or delayed (the second CMO if the CMO is the person concerned); the pre-flight plan for securing medicines is followed. See RMP-BEH-002 and RMP-BEH-001.", "source": "ng225" } ], "safety_limits": [ { "id": "L1", "name": "Contact with the crewmember", "value": "not allowed", "enforced": "Keep-out zone in the robot controller", "refs": [ "V2 10172" ] }, { "id": "L2", "name": "Holding, taking or handing over a medicine, or opening the controlled store", "value": "not allowed", "enforced": "No such task is loaded; the gripper is locked during a count" }, { "id": "L3", "name": "Showing the record count, or either count, before both counts are entered", "value": "not allowed", "enforced": "No count and no record count is sent to any display until both counts for the item are entered" }, { "id": "L4", "name": "Robot speed near the crewmember", "value": "", "enforced": "Hard limit in the controller", "refs": [ "V2 10172" ] }, { "id": "L5", "name": "Robot in a crewmember's route or blocking a medicine store during care", "value": "not allowed", "enforced": "Keep-out map in the robot controller" } ], "logs": [ { "id": "LOG-1", "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.", "refs": [ "V2 10163", "V2 10164" ] }, { "id": "LOG-2", "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.", "refs": [ "V2 10162", "V2 10172" ] }, { "id": "LOG-3", "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "LOG-4", "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.", "refs": [ "V1 7001" ] }, { "id": "LOG-5", "text": "Each item counted: both counts with who stated them, the label scan, the result, any quarantine and time; the store seal number before and after; every record correction (timestamp, CMO identity, reason, mismatched fields, item barcode, pharmacy lead decision) and its flight-surgeon flag. Reports name only the counters.", "refs": [ "V2 7059" ] }, { "id": "LOG-6", "text": "Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.", "refs": [ "V2 10163" ] } ], "requirements": [ { "id": "V1 3004", "use": "Medical care and pharmaceuticals are planned for the mission; the pharmacy lead and flight surgeon investigate discrepancies." }, { "id": "V1 3006", "use": "Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note)." }, { "id": "V1 6003", "use": "Logs and alerts sent to the ground are private medical communications." }, { "id": "V1 7001", "use": "Records kept so the flight surgeon can see trends." }, { "id": "V1 7003", "use": "Secure handling of medical records." }, { "id": "V2 7045", "use": "Usable by non-physician crew, including when the CMO is the patient." }, { "id": "V2 7046", "use": "Patient, caregiver and supplies restrained." }, { "id": "V2 7055", "use": "Medicine stores stay accessible to the crew during a count." }, { "id": "V2 7059", "use": "The inventory system tracks the location and quantity of each medicine pack; two humans count and the robot logs and compares." }, { "id": "V2 10161", "use": "Robot shows its status and health." }, { "id": "V2 10162", "use": "Mode changes are announced to the operator." }, { "id": "V2 10163", "use": "Robot records and shares its data." }, { "id": "V2 10164", "use": "Shows whether the human or the robot is expected to act." }, { "id": "V2 10165", "use": "Human can override and shut down the robot." }, { "id": "V2 10168", "use": "Human can take over." }, { "id": "V2 10172", "use": "Protective stop when a limit is exceeded." }, { "id": "V2 10173", "use": "Robot stays stopped if no one takes over." }, { "id": "V2 10174", "use": "Only a human starts or restarts the robot." } ], "validation": [ { "stage": "simulation", "what": "Seeded counts with the two counts differing, a count lower than the record, a broken seal, no witness, a request for a quarantined item, an alarm mid-count.", "pass": "Every discrepancy quarantined and flagged privately; zero hand-overs; zero counts without a witness; zero record counts shown before both counts." }, { "stage": "training model", "what": "Count of a mock controlled store.", "pass": "Count completed without the robot touching a pack." }, { "stage": "parabolic or station demonstration", "what": "Label scanning in weightlessness.", "pass": "Every pack scanned or listed." }, { "stage": "flight use under flight surgeon supervision", "what": "First counts alongside the crew's paper count.", "pass": "Agreement with the paper count; no unflagged discrepancy." } ], "signoff": { "protocol": [ "Clinical lead for the specialty (sets every clinical threshold marked )", "Flight surgeon, as medical authority", "Robotics and medical-device safety board", "Program approval for the mission" ], "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.", "each_run": "Started by the CMO or an accepted schedule prompt, with a witness present. Two humans count; the pharmacy lead and flight surgeon decide every discrepancy." }, "change_control": [ "Every change gets a new version number and a written reason; earlier versions are kept.", "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.", "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.", "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.", "The robot never changes its own protocol, thresholds or limits." ], "comms": { "live": "Low Earth orbit: the pharmacy lead and flight surgeon receive the report when the link allows.", "loss_of_signal": [ "Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation.", "Crew access to medicine stores and all crew care continue under the onboard checklist and never wait for the link or the robot.", "The robot works from the local record copy; quarantine stands without the ground." ], "mars_delay": [ "Count times are set before flight; the CMO decides on quarantined items under the onboard checklist." ] }, "sources": [ { "key": "ashp2022", "text": "American Society of Health-System Pharmacists. ASHP Guidelines on Preventing Diversion of Controlled Substances. Am J Health-Syst Pharm. 2022;79(24):2279-2306.", "url": "https://doi.org/10.1093/ajhp/zxac246", "doi": "10.1093/ajhp/zxac246", "supports": "Controlled-substance storage areas outside automated cabinets are inventoried at each shift change by two authorized health care workers; discrepancies are identified, resolved and investigated in a timely way, with discrepancy reports reviewed. Hospital context, used by analogy for a two-person count on board. Read Oct 21, 2026 (saved copy in src/b12)." }, { "key": "tb006", "text": "NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026).", "url": "https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmaceuticals.pdf", "supports": "Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059]." }, { "key": "ng225", "text": "National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022).", "url": "https://www.nice.org.uk/guidance/ng225/chapter/Recommendations", "supports": "Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm, or to decide who is offered treatment." }, { "key": "v1", "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf", "supports": "NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7003." }, { "key": "v2", "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.", "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2", "supports": "NASA-STD-3001 Vol 2 Rev F: V2 7055, V2 7059, and Section 10.6 automated and robotic systems." }, { "key": "tb044", "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf", "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist." }, { "key": "marsdelay", "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).", "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf", "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction." }, { "key": "pccp", "text": "U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance).", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "supports": "A model for planning, validating and rolling back software updates." }, { "key": "faa460", "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.", "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460", "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants." } ], "corrections": [ { "date": "2026-10-21", "version": "0.2", "source": "Batch 12 AI-assisted clinical review (Medical Research Assistant), Oct 21, 2026", "items": [ "R1: the count has its own verification kind, controlled-count, with the administration log's build-check guardrails: every hand-over rule is \"none\", robot steps declare action_type (alert, scan-compare, log, stay, send), the R5b every-field checks and the R5c layers run on it, and these lockouts are required: opening the store or holding its key or code, being the second counter or witness, holding, taking or handing over any medicine, showing the record count before both counts, naming a suspect, dose-interval cues and changing an RMP-PHARM-001 order. The reviewer's K1 to K10 run as negative tests.", "R2: a record correction fixes the record only and never takes an item out of quarantine; any use goes only through RMP-PHARM-001 on a real order. A correction is entered by the pharmacy lead from the ground, or with the link down by the CMO and the witness together (neither stating for the other), flagged and reviewed at the next contact. Source: ASHP 2022 (a pharmacist oversees discrepancy investigation); the rest is design judgment.", "R3: the mismatch statement is \"NOT VERIFIED - MISMATCH: . Record correction only; no override.\", logged as a record correction (it read \"Override by CMO logged\" while no override was allowed).", "R4: each counter enters their count privately on their own screen; no count is spoken, and neither count nor the record count is shown until both are entered (new L3). The keep-out limit is now L5.", "R5: source title corrected to NASA OCHMO, Pharmaceutical Care, Medical Technical Brief OCHMO-MTB-012 Rev B (2026), as in RMP-PHARM-003.", "Batch 12 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician." ] }, { "date": "2026-10-21", "version": "0.3", "source": "Held batch 12 verification (AI-assisted), Oct 21, 2026", "items": [ "Who decides a record correction, made consistent: S8, the record-change lockout and the D3 correction branch all say the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact); a correction is never decided by the CMO alone or by the robot (verification suggestion)." ] } ] }