{ "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json", "schema_version": "0.3", "id": "RMP-PHARM-001", "slug": "rmp-pharm-001", "title": "Fetch a medicine a human has prescribed and match it to the order by barcode (robot checks and logs; no drug advice)", "version": "0.7", "status": "draft", "conceptual": true, "not_for_clinical_use": true, "category": "pharm", "tier": 1, "rework_note": "Reworked in v0.2 after the AI-assisted review (v0.3 adds a logged, two-step CMO override): full order match (recipient identity, medicine, strength, dose form, quantity, ordered time window, expiry, storage, record flags), a hard stop with no hand-over after any mismatch, and result wording that cannot read as \"safe to take\".", "max_autonomy": 2, "missions": [ "leo", "commercial", "moon", "mars" ], "updated": "2026-10-21", "review": { "state": "reviewed-ai-assisted", "requested": "2026-10-20", "reviewed": "2026-10-20", "human_clinician_review": false, "text": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. All corrections from that review are applied in this version (see Corrections). Written with AI assistance; sources self-verified.", "verified_version": "0.7", "verified": "2026-10-20" }, "fixed_rules": { "flight_surgeon_is_medical_authority": true, "cmo_acts_under_delegated_care": true, "human_starts_and_restarts_robot": true, "robot_never_diagnoses": true, "no_drug_or_fluid_advice_by_robot": true, "safe_state_on_fault_or_no_response": true, "lost_link_pause_then_cmo_decides": true }, "robot_lockouts": { "diagnosis": true, "drug_or_fluid_advice": true, "starting_stopping_or_adjusting_oxygen_or_any_medicine": true, "self_start_or_self_restart": true, "changing_own_protocol_thresholds_or_limits": true, "handing_over_a_mismatched_item_as_verified": true }, "result_language": { "use": [ "MATCH TO ORDER (recipient, medicine, strength, form, quantity, time window, expiry, storage). Not a dose, interaction or allergy review.", "MISMATCH: . NOT VERIFIED. Quarantined.", "CANNOT VERIFY: . NOT VERIFIED. Quarantined.", "NOT VERIFIED - MISMATCH: . Override by CMO logged. (spoken and shown at a CMO override hand-over)" ], "never": [ "normal", "no problem found", "all clear", "negative", "any diagnosis or cause", "MATCH (on its own, without \"to order\")", "verified safe", "safe to take", "OK to give", "recommended", "use instead" ] }, "verification": { "fields": [ "recipient_identity", "crewmember_on_order", "medicine", "strength", "dose_form", "quantity", "time_window", "expiry", "storage", "record_flags" ], "recipient_check": "At hand-over the robot confirms the recipient by crew ID scan, or the CMO confirms the recipient by voice; the identity must equal the crewmember on the order.", "match_label": "MATCH TO ORDER. Not a dose, interaction or allergy review.", "on_mismatch": { "hard_stop": true, "default": "Sealed in a labeled NOT VERIFIED bag and placed in the quarantine bin.", "unprompted_handoff": false, "handoff_to_anyone_but_cmo": false, "logged_as": "override", "cmo_override": { "allowed": true, "who": "CMO", "request": "Two-step: the CMO states the override and its reason, then confirms in a separate step. The robot confirms the CMO's identity (crew ID scan or voice) before releasing the item.", "steps": [ "The CMO states \"override\" and the reason; the robot reads back the mismatched fields and the reason.", "The CMO confirms the override in a separate, deliberate step (for example a second spoken confirmation or a confirm button)." ], "log": [ "timestamp", "cmo_identity", "reason", "mismatched_fields", "order_id", "item_barcode" ], "notify_flight_surgeon": "An override flag goes to the flight surgeon at once; if the link is down, it is queued and sent at the next contact.", "statement": "NOT VERIFIED - MISMATCH: . Override by CMO logged.", "decided": "Protocol-owner decision, Oct 20, 2026, following the reviewer's original suggestion." } }, "scan_failure": "No MATCH; the item is quarantined, and is handed over only through the logged CMO override. The CMO follows the pre-approved escalation process for scan failures: verify by eye against the order (a second crewmember when available: design suggestion, not from the cited source), never scan a substitute label or another package (proxy scan), and log an override." }, "scope": { "summary": "After the CMO or flight surgeon has decided on a medicine, the robot fetches it from stowage and checks it against every field of the human order: the crewmember, medicine, strength, dose form, quantity and ordered time window, plus expiry, storage record and human-entered record flags. At hand-over it confirms the recipient is the ordered crewmember. Only a full MATCH TO ORDER is handed to the CMO. Any mismatch or failed check is a hard stop: the item is quarantined, not handed over. The robot never chooses, recommends, doses or gives a medicine, and a match is not a clinical safety check.", "why": "In one hospital before-and-after study, bar-code verification cut non-timing administration errors by 41% and related potential adverse drug events by 51%, but did not eliminate errors. Barcode checks aim to confirm the right patient, drug, dose, route and time, and workarounds such as proxy scanning undermine them. On long missions, medicines may outlast their expiry dates, so expiry and storage checks matter, and NASA requires inventory tracking of item locations and quantities.", "covers": [ "Fetching a medicine already ordered by the CMO or flight surgeon and matching it to the order", "Returning unused items to their stowage location and updating inventory" ], "locked_out": [ "Choosing, recommending, substituting or dosing any medicine", "Answering questions about medicines (routed to the CMO or flight surgeon)", "Handing over any item after a mismatch, a failed scan or a failed recipient check, except to the CMO through the logged two-step override", "Handing a NOT VERIFIED item to anyone other than the CMO", "Scanning a substitute label or another package (proxy scanning)", "Deciding whether an expired or out-of-storage item may be used (CMO and flight surgeon only)", "Opening packages or handling loose tablets", "Giving a medicine to a crewmember", "Controlled-medicine counts (two-person check, RMP-PHARM-004)" ], "related": [ "RMP-PHARM-002", "RMP-PHARM-003", "RMP-PHARM-004" ] }, "roles": { "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.", "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.", "others": [ "Prescriber: the flight surgeon, or the CMO under the onboard checklist", "Recipient: the crewmember named on the order" ], "robot_may": [ "Read back the order for confirmation", "Fetch the item from its stowage location", "Compare it with every order field, the expiry date, the storage record and record flags", "Confirm the recipient's identity at hand-over", "Hand over an item only after a full MATCH TO ORDER", "Quarantine any item that does not match", "Hand a NOT VERIFIED item to the CMO only on the CMO's two-step override, stating the mismatched fields", "Update inventory and flag low stock" ], "robot_may_not": [ "Suggest a medicine, dose or alternative", "Hand over a NOT VERIFIED item unprompted, or to anyone other than the CMO", "Accept an override without the two-step confirm, the reason and the log", "Say or show that an item is safe, OK or verified safe", "Scan anything other than the item's own package", "Open packaging", "Delay the crew from taking an item directly in an emergency" ], "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)" }, "preconditions": [ { "id": "PRE-1", "text": "A complete human order exists: prescriber, crewmember, medicine, strength, dose form, quantity and ordered time window.", "check": "order.complete == true" }, { "id": "PRE-2", "text": "The CMO started the run.", "check": "human_start == true", "refs": [ "V2 10174" ] }, { "id": "PRE-3", "text": "Inventory database synced (or the local copy is in use, with the CMO's confirmation); barcode scanner and crew ID scanner self-tests passed.", "refs": [ "V2 10161" ] }, { "id": "PRE-4", "text": "Not an emergency where seconds matter: in an emergency the crew take items directly and the robot logs afterward." } ], "consent": { "standard": "The CMO confirms the order on read-back. The recipient's consent to the medicine is a CMO responsibility, outside the robot's role.", "emergency": "In an emergency the crew bypass the robot; it reconciles inventory afterward.", "withdrawal": "The CMO can cancel the fetch at any time; the item is returned to stowage." }, "inputs": [ { "id": "IN-1", "name": "Human order (prescriber, crewmember, medicine, strength, dose form, quantity, ordered time window)", "source": "CMO entry or flight surgeon uplink", "required": true, "if_missing": "Robot does not fetch; asks the CMO to complete the order." }, { "id": "IN-2", "name": "Barcode or RFID identity of the package itself", "source": "Robot scanner", "required": true, "if_missing": "CANNOT VERIFY; no hand-over; the CMO follows the scan-failure escalation process. Never scan a substitute label." }, { "id": "IN-3", "name": "Recipient identity at hand-over", "source": "Crew ID scan, or the CMO's voice confirmation", "required": true, "if_missing": "CANNOT VERIFY: recipient; quarantined (hand-over only through the logged CMO override)." }, { "id": "IN-4", "name": "Current time against the ordered time window", "source": "Vehicle clock", "required": true, "if_missing": "CANNOT VERIFY: time; quarantined (hand-over only through the logged CMO override)." }, { "id": "IN-5", "name": "Stowage location and quantity", "source": "Inventory system", "required": true, "if_missing": "Ask the CMO; flag an inventory discrepancy." }, { "id": "IN-6", "name": "Expiry date and storage-temperature record", "source": "Package label and storage log", "required": true, "if_missing": "MISMATCH: expiry or storage status unknown; quarantined (hand-over only through the logged CMO override)." }, { "id": "IN-7", "name": "Allergy and other flags entered in the crewmember's record by humans", "source": "Medical record", "required": true, "if_missing": "CANNOT VERIFY: record flags unavailable; quarantined (hand-over only through the logged CMO override)." }, { "id": "IN-8", "name": "Link status", "source": "Communications system", "required": false, "if_missing": "Tell the CMO; on the CMO's confirmation work offline from the local inventory copy; sync later." } ], "steps": [ { "id": "S1", "actor": "crew", "action": "The CMO enters the order, or confirms one uplinked by the flight surgeon.", "success": "Order complete." }, { "id": "S2", "actor": "robot", "rung": 2, "action": "Read the order back aloud and on screen: crewmember, medicine, strength, dose form, quantity and time window; the CMO confirms.", "success": "CMO confirms the read-back." }, { "id": "S3", "actor": "robot", "rung": 2, "action": "Find the item's stowage location and retrieve it without opening the packaging.", "success": "Item in gripper; location logged.", "refs": [ "V2 7052" ] }, { "id": "S4", "actor": "robot", "rung": 2, "action": "Scan the item's own barcode and compare every field: crewmember on the order, medicine, strength, dose form, quantity and ordered time window; check expiry date, storage record and human-entered record flags. Expiry or storage problems are shown as MISMATCH here, before any hand-over.", "success": "Every field checked and shown on screen.", "refs": [ "V2 10170", "V2 10171" ] }, { "id": "S5", "actor": "robot", "rung": 2, "action": "Confirm the recipient's identity (crew ID scan, or the CMO confirms by voice) against the crewmember on the order.", "success": "Recipient identity checked." }, { "id": "S6", "actor": "robot", "rung": 2, "action": "Only after a full match: show \"MATCH TO ORDER. Not a dose, interaction or allergy review.\" and hand the item to the CMO.", "success": "CMO acknowledges the screen and takes the item.", "refs": [ "V2 10170" ] }, { "id": "S7", "actor": "robot", "rung": 2, "action": "Only after a mismatch or failed check, and only on the CMO's two-step override (the CMO states the override and its reason, then confirms): confirm the CMO's identity; log the timestamp, CMO identity, reason, mismatched fields, order and item barcode; flag the override to the flight surgeon (queued if the link is down); state and show \"NOT VERIFIED - MISMATCH: . Override by CMO logged.\" and hand the item to the CMO only.", "success": "Override logged and flagged; item in the CMO's hands; or no override requested and the item stays in quarantine.", "refs": [ "V2 10165", "V2 10163", "V2 10170" ] }, { "id": "S8", "actor": "crew", "action": "CMO checks the item by eye and decides whether and how to give it (outside the robot's role).", "success": "CMO accepts or rejects; logged." }, { "id": "S9", "actor": "robot", "rung": 2, "action": "Log the fetch and every check; update the inventory count; flag low stock to the ground.", "success": "Inventory updated.", "refs": [ "V2 7059" ] }, { "id": "S10", "actor": "robot", "rung": 2, "action": "Return any unused or rejected item to its stowage location (quarantined items stay in the quarantine bin).", "success": "Item stowed; inventory updated.", "refs": [ "V2 7052" ] } ], "decisions": [ { "id": "D1", "after": "S3", "decided_by": "robot", "question": "Was the item found where inventory says, in the expected quantity?", "branches": [ { "if": "Yes", "then": "Continue." }, { "if": "No", "then": "Flag an inventory discrepancy to crew and ground; ask the CMO." } ] }, { "id": "D2", "after": "S4", "decided_by": "robot", "question": "Did every order field, expiry, storage and record-flag check match?", "branches": [ { "if": "Yes", "then": "Continue to the recipient check (S5)." }, { "if": "No, or a check could not be done", "then": "HARD STOP. Show MISMATCH or CANNOT VERIFY with the fields named. Seal the item in a labeled NOT VERIFIED bag and place it in the quarantine bin. No hand-over. The CMO and flight surgeon decide what happens next (for example whether an expired item may be used).", "handoff": "none" }, { "if": "The CMO makes an explicit two-step override request (states the override and its reason, then confirms)", "then": "Go to S7: after logging and flagging, hand the item to the CMO only, stating \"NOT VERIFIED - MISMATCH: . Override by CMO logged.\"", "handoff": "cmo-override-only", "override": { "requested_by": "CMO", "two_step_confirm": true, "log": [ "timestamp", "cmo_identity", "reason", "mismatched_fields", "order_id", "item_barcode" ], "notify_flight_surgeon": true, "statement": "NOT VERIFIED - MISMATCH: . Override by CMO logged." } } ] }, { "id": "D3", "after": "S5", "decided_by": "robot", "question": "Is the recipient the crewmember on the order?", "branches": [ { "if": "Yes", "then": "Continue to S6." }, { "if": "No, or identity not confirmed", "then": "HARD STOP: MISMATCH: recipient. Quarantine the item. No hand-over. Alert the CMO.", "handoff": "none" }, { "if": "The CMO makes an explicit two-step override request", "then": "Go to S7: after logging and flagging, hand the item to the CMO only, stating \"NOT VERIFIED - MISMATCH: . Override by CMO logged.\"", "handoff": "cmo-override-only", "override": { "requested_by": "CMO", "two_step_confirm": true, "log": [ "timestamp", "cmo_identity", "reason", "mismatched_fields", "order_id", "item_barcode" ], "notify_flight_surgeon": true, "statement": "NOT VERIFIED - MISMATCH: . Override by CMO logged." } } ] } ], "stop_rules": [ { "id": "X1", "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent", "action": "The fetch stops at once; the robot returns the item to stowage (or to quarantine if a check failed) and tells the CMO.", "level": "stop", "refs": [ "V2 10165" ] }, { "id": "X2", "trigger": "Any crewmember presses stop or takes over control", "action": "Protective stop; robot holds its stopped position; only a human may restart it.", "level": "safe-state", "refs": [ "V2 10165", "V2 10168", "V2 10174" ] }, { "id": "X3", "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached", "action": "Protective stop and hand control to the CMO; log the fault.", "level": "safe-state", "refs": [ "V2 10172", "V2 10168" ] }, { "id": "X4", "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)", "action": "Robot stays stopped; the next named crewmember is called.", "level": "safe-state", "refs": [ "V2 10173", "V2 7045" ] }, { "id": "X5", "trigger": "Loss of link, or delay longer than the limit for live guidance", "action": "Only the robot pauses; crew care never waits for the link or the robot. Loss of link does not stop this protocol by itself. The robot pauses any movement and tells the CMO; on the CMO's confirmation it continues offline from the local inventory copy and syncs at the next contact.", "level": "pause", "refs": [ "V2 10172", "V2 10173" ] }, { "id": "X6", "trigger": "Any mismatch, failed scan, failed recipient check, or a check that cannot be done", "action": "Hard stop: item sealed in a labeled NOT VERIFIED bag and quarantined. The robot never hands it over unprompted, and never to anyone other than the CMO. Hand-over only on the CMO's two-step override, logged and flagged to the flight surgeon (S7).", "level": "stop", "refs": [ "V2 10172" ] }, { "id": "X7", "trigger": "The order changes during the fetch", "action": "Stop; discard the old order; read back the new one.", "level": "stop" }, { "id": "X8", "trigger": "A crewmember asks the robot for medicine advice, or anyone other than the CMO asks for a quarantined item, or an override is requested without the two-step confirm and a reason", "action": "Robot declines and routes the request to the CMO or flight surgeon; the item stays in quarantine.", "level": "stop" } ], "red_flags": [ { "id": "RF1", "sign": "Any field mismatch, including recipient", "threshold": "any", "action": "Hard stop; quarantine; no hand-over unless the CMO makes the logged two-step override; CMO decides" }, { "id": "RF2", "sign": "A human-entered allergy or other flag in the crewmember's record", "threshold": "any", "action": "Hard stop; quarantine; CMO and flight surgeon decide" }, { "id": "RF3", "sign": "Storage temperature outside limits", "threshold": "beyond ", "action": "MISMATCH: storage; quarantine; CMO decides" }, { "id": "RF4", "sign": "CMO override hand-over of a NOT VERIFIED item", "threshold": "any", "action": "Logged (timestamp, CMO, reason, mismatched fields); flag sent to the flight surgeon at once, or at the next contact if the link is down" }, { "id": "RF5", "sign": "Stock below the reorder level", "threshold": "", "action": "Flag to ground for resupply planning" } ], "safety_limits": [ { "id": "L1", "name": "Hand-over after a mismatch or failed check without a completed, logged CMO two-step override", "value": "not allowed", "enforced": "Gripper release to a person is blocked unless all checks passed, or the identified CMO completed the two-step override and the log entry was written", "refs": [ "V2 10172" ] }, { "id": "L2", "name": "Hand-over of a NOT VERIFIED item to anyone other than the CMO", "value": "not allowed", "enforced": "Release requires the CMO's identity check" }, { "id": "L3", "name": "Proxy scanning (any label other than the item's own package)", "value": "not allowed", "enforced": "Scanner accepts only the item held in the gripper" }, { "id": "L4", "name": "Opening packaging", "value": "not allowed", "enforced": "Gripper task limits" }, { "id": "L5", "name": "Gripper force on vials and blister packs", "value": "", "enforced": "Force sensing", "refs": [ "V2 10172" ] }, { "id": "L6", "name": "Sharps (uncapped needles)", "value": "not allowed", "enforced": "Robot refuses items tagged as uncapped sharps" }, { "id": "L7", "name": "Time from order to hand-over", "value": "", "enforced": "Logged; crew may fetch directly" } ], "logs": [ { "id": "LOG-1", "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.", "refs": [ "V2 10163", "V2 10164" ] }, { "id": "LOG-2", "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.", "refs": [ "V2 10162", "V2 10172" ] }, { "id": "LOG-3", "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "LOG-4", "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.", "refs": [ "V1 7001" ] }, { "id": "LOG-5", "text": "Every fetch, field-by-field result, mismatch, quarantine, CMO decision and inventory change, linked to the order. Every override records the timestamp, CMO identity, reason, mismatched fields, order and item barcode, and when the flight surgeon flag was sent." } ], "requirements": [ { "id": "V1 3004", "use": "In-mission care includes inventory monitoring and administering and managing all medications (a human capability)." }, { "id": "V1 3006", "use": "Two crew medical officers per vehicle for NASA programs (see the commercial-flight note)." }, { "id": "V1 6003", "use": "Private medical communications." }, { "id": "V1 7001", "use": "Records kept in retrievable form." }, { "id": "V1 7003", "use": "Secure records." }, { "id": "V2 7045", "use": "Usable by non-physician crew, including when the CMO is the patient." }, { "id": "V2 7052", "use": "Relocatable items have a dedicated stowage location." }, { "id": "V2 7059", "use": "Inventory system tracks locations and quantities of items." }, { "id": "V2 10161", "use": "Status shown." }, { "id": "V2 10162", "use": "Mode changes are announced to the operator." }, { "id": "V2 10163", "use": "Data recorded and shared." }, { "id": "V2 10164", "use": "Shows who acts." }, { "id": "V2 10165", "use": "Human override." }, { "id": "V2 10168", "use": "Human can take over." }, { "id": "V2 10170", "use": "The screen shows each field compared and why it matched or not." }, { "id": "V2 10171", "use": "Robot says when it cannot verify (unreadable code, missing data, identity not confirmed)." }, { "id": "V2 10172", "use": "Protective stop." }, { "id": "V2 10173", "use": "Robot stays stopped if no one takes over." }, { "id": "V2 10174", "use": "Only a human starts or restarts the robot." } ], "validation": [ { "stage": "simulation", "what": "Simulated inventory with seeded errors (wrong recipient, wrong strength or form, outside the time window, expired, out-of-storage, unreadable code, proxy label).", "pass": "Every seeded error caught; zero false MATCH TO ORDER results; zero hand-overs after a mismatch." }, { "stage": "training model", "what": "Mock-up stowage with real packaging and labels.", "pass": "Retrieval success and scan accuracy at or above ." }, { "stage": "Earth analog", "what": "Analog crews using the robot for routine medicines.", "pass": "Zero unverified hand-overs; overrides reviewed; crew workload not increased." }, { "stage": "flight use under flight surgeon supervision", "what": "Inventory checks first, then non-urgent fetches.", "pass": "Inventory accuracy at or above ; no safety events." } ], "signoff": { "protocol": [ "Clinical lead for the specialty (sets every clinical threshold marked )", "Flight surgeon, as medical authority", "Robotics and medical-device safety board", "Program approval for the mission" ], "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.", "each_run": "Started by the CMO after a human order. No flight surgeon real-time presence needed; overrides reviewed by the flight surgeon at the next contact." }, "change_control": [ "Every change gets a new version number and a written reason; earlier versions are kept.", "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.", "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.", "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.", "The robot never changes its own protocol, thresholds or limits." ], "comms": { "live": "Low Earth orbit: the flight surgeon can uplink orders; inventory syncs with the ground.", "loss_of_signal": [ "Only the robot pauses; crew care never waits for the link or the robot.", "The robot tells the CMO; on the CMO's confirmation it works from the local inventory copy, and the CMO enters orders onboard.", "Inventory, logs and overrides sync at the next contact." ], "mars_delay": [ "All orders are entered onboard; the robot never waits for the ground to match an item to the order.", "Inventory, expiry, override and resupply data go to the ground as packages." ] }, "sources": [ { "key": "poon", "text": "Poon EG, Keohane CA, Yoon CS, et al. Effect of bar-code technology on the safety of medication administration. N Engl J Med. 2010;362(18):1698-1707.", "url": "https://doi.org/10.1056/NEJMsa0907115", "doi": "10.1056/NEJMsa0907115", "pmid": "20445181", "supports": "In one hospital before-and-after study, bar-code verification cut non-timing administration errors by 41.4% and related potential adverse drug events (other than those from timing errors) by 50.8%, but did not eliminate errors; timing errors fell, but timing-related potential adverse drug events did not change." }, { "key": "koppel", "text": "Koppel R, Wetterneck T, Telles JL, Karsh BT. Workarounds to barcode medication administration systems: their occurrences, causes, and threats to patient safety. J Am Med Inform Assoc. 2008;15(4):408-423.", "url": "https://doi.org/10.1197/jamia.M2616", "doi": "10.1197/jamia.M2616", "pmid": "18436903", "supports": "Barcode medication administration aims to help confirm the five 'rights': right patient, drug, dose, route and time; workarounds (for example unreadable barcodes, or patient ID barcodes stuck to carts or doorframes) undermine it." }, { "key": "ismp", "text": "Institute for Safe Medication Practices. Lack of proper escalation process for BCMA scanning failures. ISMP Medication Safety Alert! Acute Care, March 21, 2024.", "url": "https://www.ismp.org/sites/default/files/newsletter-issues/20240321.pdf", "supports": "Procedures must include an escalation process for barcode scanning failures; unsafe practices include giving a medicine when the barcode will not scan and scanning barcodes from sources other than the medicine itself (proxy scanning)." }, { "key": "tb006", "text": "NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026).", "url": "https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmaceuticals.pdf", "supports": "Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059]." }, { "key": "tb044", "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf", "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist." }, { "key": "v1", "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf", "supports": "Requirement IDs beginning V1." }, { "key": "v2", "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.", "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2", "supports": "Requirement IDs beginning V2." }, { "key": "marsdelay", "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).", "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf", "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction." }, { "key": "pccp", "text": "U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance).", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "supports": "A model for planning, validating and rolling back software updates." }, { "key": "faa460", "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.", "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460", "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants." } ], "corrections": [ { "date": "2026-10-20", "version": "0.3", "source": "Protocol-owner decision, Oct 20, 2026, following the reviewer's original suggestion (item 30 of the AI-assisted review)", "items": [ "After a mismatch or failed scan, the robot may hand the item to the CMO, but only on the CMO's explicit two-step override: the CMO states the override and its reason, then confirms.", "Each override is logged with the timestamp, CMO identity, reason, mismatched fields, order and item barcode, and flagged to the flight surgeon (at the next contact if the link is down).", "At hand-over the robot states \"NOT VERIFIED - MISMATCH: . Override by CMO logged.\"", "Unchanged default: on any mismatch the item is sealed in the NOT VERIFIED bag and quarantined; the robot never hands it over unprompted, and never to anyone other than the CMO. The ban on \"safe\" wording stays.", "The schema and build now allow a hand-over after a mismatch only through a branch marked as a CMO override with the logging and flight surgeon notification fields." ] }, { "date": "2026-10-20", "version": "0.2", "source": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026", "items": [ "REWORKED. The robot now matches every order field: recipient identity at hand-over, crewmember on the order, medicine, strength, dose form, quantity and ordered time window, plus expiry, storage and record flags (Koppel 2008).", "Any mismatch, failed scan or failed recipient check is a hard stop with no hand-over: the item is quarantined in a NOT VERIFIED bag; only the CMO may take it out, by hand, logged as an override (ISMP 2024).", "Result wording is now \"MATCH TO ORDER. Not a dose, interaction or allergy review.\"; \"verified safe\", \"safe to take\" and \"OK to give\" are banned.", "Expiry and storage problems are shown as MISMATCH before any hand-over; whether to use the item is a human decision (NASA TB-006).", "Unreadable barcodes: no hand-over; scan-failure escalation; no proxy scanning (ISMP 2024). The second-crewmember check is marked as a design suggestion.", "Poon 2010 wording made precise (non-timing errors; did not eliminate errors).", "X5 link loss: pause, then continue offline on the CMO's confirmation.", "X1 now stops the fetch (no patient recording in this protocol).", "The pharmacy lead is now an allowed placeholder owner in the schema.", "Version 0.2 sent any mismatched item to quarantine with no hand-over at all (stricter than the reviewer's suggestion); see the v0.3 note above.", "Loss of link (X5) now means: pause motion, tell the CMO, and continue offline only on the CMO's confirmation (fixes the contradiction with the comms branch).", "Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build." ] }, { "date": "2026-10-21", "version": "0.3", "source": "Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49", "items": [ "Inherited stop-rule and requirement wording: \"holds a safe position\" → \"holds its stopped position\"; \"stays in its safe state\" → \"stays stopped\"; \"take over safely\" → \"take over\"; \"Robot stays safe if no one takes over\" → \"Robot stays stopped if no one takes over\". Schema level name safe-state and never-word list entry \"safe\" unchanged." ] }, { "date": "2026-10-21", "version": "0.4", "source": "Batch 6 editorial (AI-assisted), Oct 21, 2026", "items": [ "Requirement use for [V2 10173] changed from \"Safe default.\" to \"Robot stays stopped if no one takes over.\" (batch 5 review item 25; editorial, behaviour unchanged). The PHARM-001 mismatch rule is unchanged: quarantine by default, hand-over only on the CMO's explicit two-step request, logged as an override and flagged to the flight surgeon." ] }, { "date": "2026-10-21", "version": "0.5", "source": "Batch 7 editorial (AI-assisted), Oct 21, 2026", "items": [ "Citation labels changed to the site's year-only convention: \"(approved for public release )\" now reads \"(YYYY)\", and NASA-STD-3001 Volume 2 \"Revision F (approved July 14, 2026)\" now reads \"(Rev F, 2026)\" (sources: v2). Editorial; no change to steps, thresholds or limits." ] }, { "date": "2026-10-21", "version": "0.6", "source": "Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026", "items": [ "X5 and the comms loss-of-signal branch now open with \"Only the robot pauses; crew care never waits for the link or the robot.\" (batch 7 review suggestion 29). Editorial; robot behaviour unchanged." ] }, { "date": "2026-10-21", "version": "0.7", "source": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 8 review), editorial", "items": [ "Source tb006 now names the document its link serves: NASA Medical Technical Brief OCHMO-MTB-012, Pharmaceutical Care, Rev B (2026); it was cited as OCHMO-TB-006 (2023). The claims cited are unchanged (batch 8 review fix 6).", "Citation label only; the medication rule (quarantine by default, hand-over only on the CMO's explicit two-step request, logged as an override and flagged to the flight surgeon) is unchanged." ] } ] }