# RMP-PHARM-001 Fetch a medicine a human has prescribed and match it to the order by barcode (robot checks and logs; no drug advice) # Version 0.7 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' id: RMP-PHARM-001 slug: rmp-pharm-001 title: >- Fetch a medicine a human has prescribed and match it to the order by barcode (robot checks and logs; no drug advice) version: '0.7' status: draft conceptual: true not_for_clinical_use: true category: pharm tier: 1 rework_note: >- Reworked in v0.2 after the AI-assisted review (v0.3 adds a logged, two-step CMO override): full order match (recipient identity, medicine, strength, dose form, quantity, ordered time window, expiry, storage, record flags), a hard stop with no hand-over after any mismatch, and result wording that cannot read as "safe to take". max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-20' reviewed: '2026-10-20' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. All corrections from that review are applied in this version (see Corrections). Written with AI assistance; sources self-verified. verified_version: '0.7' verified: '2026-10-20' fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true result_language: use: - >- MATCH TO ORDER (recipient, medicine, strength, form, quantity, time window, expiry, storage). Not a dose, interaction or allergy review. - 'MISMATCH: . NOT VERIFIED. Quarantined.' - 'CANNOT VERIFY: . NOT VERIFIED. Quarantined.' - >- NOT VERIFIED - MISMATCH: . Override by CMO logged. (spoken and shown at a CMO override hand-over) never: - normal - no problem found - all clear - negative - any diagnosis or cause - MATCH (on its own, without "to order") - verified safe - safe to take - OK to give - recommended - use instead verification: fields: - recipient_identity - crewmember_on_order - medicine - strength - dose_form - quantity - time_window - expiry - storage - record_flags recipient_check: >- At hand-over the robot confirms the recipient by crew ID scan, or the CMO confirms the recipient by voice; the identity must equal the crewmember on the order. match_label: MATCH TO ORDER. Not a dose, interaction or allergy review. on_mismatch: hard_stop: true default: Sealed in a labeled NOT VERIFIED bag and placed in the quarantine bin. unprompted_handoff: false handoff_to_anyone_but_cmo: false logged_as: override cmo_override: allowed: true who: CMO request: >- Two-step: the CMO states the override and its reason, then confirms in a separate step. The robot confirms the CMO's identity (crew ID scan or voice) before releasing the item. steps: - The CMO states "override" and the reason; the robot reads back the mismatched fields and the reason. - >- The CMO confirms the override in a separate, deliberate step (for example a second spoken confirmation or a confirm button). log: - timestamp - cmo_identity - reason - mismatched_fields - order_id - item_barcode notify_flight_surgeon: >- An override flag goes to the flight surgeon at once; if the link is down, it is queued and sent at the next contact. statement: 'NOT VERIFIED - MISMATCH: . Override by CMO logged.' decided: Protocol-owner decision, Oct 20, 2026, following the reviewer's original suggestion. scan_failure: >- No MATCH; the item is quarantined, and is handed over only through the logged CMO override. The CMO follows the pre-approved escalation process for scan failures: verify by eye against the order (a second crewmember when available: design suggestion, not from the cited source), never scan a substitute label or another package (proxy scan), and log an override. scope: summary: >- After the CMO or flight surgeon has decided on a medicine, the robot fetches it from stowage and checks it against every field of the human order: the crewmember, medicine, strength, dose form, quantity and ordered time window, plus expiry, storage record and human-entered record flags. At hand-over it confirms the recipient is the ordered crewmember. Only a full MATCH TO ORDER is handed to the CMO. Any mismatch or failed check is a hard stop: the item is quarantined, not handed over. The robot never chooses, recommends, doses or gives a medicine, and a match is not a clinical safety check. why: >- In one hospital before-and-after study, bar-code verification cut non-timing administration errors by 41% and related potential adverse drug events by 51%, but did not eliminate errors. Barcode checks aim to confirm the right patient, drug, dose, route and time, and workarounds such as proxy scanning undermine them. On long missions, medicines may outlast their expiry dates, so expiry and storage checks matter, and NASA requires inventory tracking of item locations and quantities. covers: - Fetching a medicine already ordered by the CMO or flight surgeon and matching it to the order - Returning unused items to their stowage location and updating inventory locked_out: - Choosing, recommending, substituting or dosing any medicine - Answering questions about medicines (routed to the CMO or flight surgeon) - >- Handing over any item after a mismatch, a failed scan or a failed recipient check, except to the CMO through the logged two-step override - Handing a NOT VERIFIED item to anyone other than the CMO - Scanning a substitute label or another package (proxy scanning) - Deciding whether an expired or out-of-storage item may be used (CMO and flight surgeon only) - Opening packages or handling loose tablets - Giving a medicine to a crewmember - Controlled-medicine counts (two-person check, RMP-PHARM-004) related: - RMP-PHARM-002 - RMP-PHARM-003 - RMP-PHARM-004 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Prescriber: the flight surgeon, or the CMO under the onboard checklist' - 'Recipient: the crewmember named on the order' robot_may: - Read back the order for confirmation - Fetch the item from its stowage location - Compare it with every order field, the expiry date, the storage record and record flags - Confirm the recipient's identity at hand-over - Hand over an item only after a full MATCH TO ORDER - Quarantine any item that does not match - >- Hand a NOT VERIFIED item to the CMO only on the CMO's two-step override, stating the mismatched fields - Update inventory and flag low stock robot_may_not: - Suggest a medicine, dose or alternative - Hand over a NOT VERIFIED item unprompted, or to anyone other than the CMO - Accept an override without the two-step confirm, the reason and the log - Say or show that an item is safe, OK or verified safe - Scan anything other than the item's own package - Open packaging - Delay the crew from taking an item directly in an emergency commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- A complete human order exists: prescriber, crewmember, medicine, strength, dose form, quantity and ordered time window. check: order.complete == true - id: PRE-2 text: The CMO started the run. check: human_start == true refs: - V2 10174 - id: PRE-3 text: >- Inventory database synced (or the local copy is in use, with the CMO's confirmation); barcode scanner and crew ID scanner self-tests passed. refs: - V2 10161 - id: PRE-4 text: >- Not an emergency where seconds matter: in an emergency the crew take items directly and the robot logs afterward. consent: standard: >- The CMO confirms the order on read-back. The recipient's consent to the medicine is a CMO responsibility, outside the robot's role. emergency: In an emergency the crew bypass the robot; it reconciles inventory afterward. withdrawal: The CMO can cancel the fetch at any time; the item is returned to stowage. inputs: - id: IN-1 name: Human order (prescriber, crewmember, medicine, strength, dose form, quantity, ordered time window) source: CMO entry or flight surgeon uplink required: true if_missing: Robot does not fetch; asks the CMO to complete the order. - id: IN-2 name: Barcode or RFID identity of the package itself source: Robot scanner required: true if_missing: >- CANNOT VERIFY; no hand-over; the CMO follows the scan-failure escalation process. Never scan a substitute label. - id: IN-3 name: Recipient identity at hand-over source: Crew ID scan, or the CMO's voice confirmation required: true if_missing: 'CANNOT VERIFY: recipient; quarantined (hand-over only through the logged CMO override).' - id: IN-4 name: Current time against the ordered time window source: Vehicle clock required: true if_missing: 'CANNOT VERIFY: time; quarantined (hand-over only through the logged CMO override).' - id: IN-5 name: Stowage location and quantity source: Inventory system required: true if_missing: Ask the CMO; flag an inventory discrepancy. - id: IN-6 name: Expiry date and storage-temperature record source: Package label and storage log required: true if_missing: >- MISMATCH: expiry or storage status unknown; quarantined (hand-over only through the logged CMO override). - id: IN-7 name: Allergy and other flags entered in the crewmember's record by humans source: Medical record required: true if_missing: >- CANNOT VERIFY: record flags unavailable; quarantined (hand-over only through the logged CMO override). - id: IN-8 name: Link status source: Communications system required: false if_missing: Tell the CMO; on the CMO's confirmation work offline from the local inventory copy; sync later. steps: - id: S1 actor: crew action: The CMO enters the order, or confirms one uplinked by the flight surgeon. success: Order complete. - id: S2 actor: robot rung: 2 action: >- Read the order back aloud and on screen: crewmember, medicine, strength, dose form, quantity and time window; the CMO confirms. success: CMO confirms the read-back. - id: S3 actor: robot rung: 2 action: Find the item's stowage location and retrieve it without opening the packaging. success: Item in gripper; location logged. refs: - V2 7052 - id: S4 actor: robot rung: 2 action: >- Scan the item's own barcode and compare every field: crewmember on the order, medicine, strength, dose form, quantity and ordered time window; check expiry date, storage record and human-entered record flags. Expiry or storage problems are shown as MISMATCH here, before any hand-over. success: Every field checked and shown on screen. refs: - V2 10170 - V2 10171 - id: S5 actor: robot rung: 2 action: >- Confirm the recipient's identity (crew ID scan, or the CMO confirms by voice) against the crewmember on the order. success: Recipient identity checked. - id: S6 actor: robot rung: 2 action: >- Only after a full match: show "MATCH TO ORDER. Not a dose, interaction or allergy review." and hand the item to the CMO. success: CMO acknowledges the screen and takes the item. refs: - V2 10170 - id: S7 actor: robot rung: 2 action: >- Only after a mismatch or failed check, and only on the CMO's two-step override (the CMO states the override and its reason, then confirms): confirm the CMO's identity; log the timestamp, CMO identity, reason, mismatched fields, order and item barcode; flag the override to the flight surgeon (queued if the link is down); state and show "NOT VERIFIED - MISMATCH: . Override by CMO logged." and hand the item to the CMO only. success: >- Override logged and flagged; item in the CMO's hands; or no override requested and the item stays in quarantine. refs: - V2 10165 - V2 10163 - V2 10170 - id: S8 actor: crew action: CMO checks the item by eye and decides whether and how to give it (outside the robot's role). success: CMO accepts or rejects; logged. - id: S9 actor: robot rung: 2 action: Log the fetch and every check; update the inventory count; flag low stock to the ground. success: Inventory updated. refs: - V2 7059 - id: S10 actor: robot rung: 2 action: >- Return any unused or rejected item to its stowage location (quarantined items stay in the quarantine bin). success: Item stowed; inventory updated. refs: - V2 7052 decisions: - id: D1 after: S3 decided_by: robot question: Was the item found where inventory says, in the expected quantity? branches: - if: 'Yes' then: Continue. - if: 'No' then: Flag an inventory discrepancy to crew and ground; ask the CMO. - id: D2 after: S4 decided_by: robot question: Did every order field, expiry, storage and record-flag check match? branches: - if: 'Yes' then: Continue to the recipient check (S5). - if: No, or a check could not be done then: >- HARD STOP. Show MISMATCH or CANNOT VERIFY with the fields named. Seal the item in a labeled NOT VERIFIED bag and place it in the quarantine bin. No hand-over. The CMO and flight surgeon decide what happens next (for example whether an expired item may be used). handoff: none - if: >- The CMO makes an explicit two-step override request (states the override and its reason, then confirms) then: >- Go to S7: after logging and flagging, hand the item to the CMO only, stating "NOT VERIFIED - MISMATCH: . Override by CMO logged." handoff: cmo-override-only override: requested_by: CMO two_step_confirm: true log: - timestamp - cmo_identity - reason - mismatched_fields - order_id - item_barcode notify_flight_surgeon: true statement: 'NOT VERIFIED - MISMATCH: . Override by CMO logged.' - id: D3 after: S5 decided_by: robot question: Is the recipient the crewmember on the order? branches: - if: 'Yes' then: Continue to S6. - if: No, or identity not confirmed then: 'HARD STOP: MISMATCH: recipient. Quarantine the item. No hand-over. Alert the CMO.' handoff: none - if: The CMO makes an explicit two-step override request then: >- Go to S7: after logging and flagging, hand the item to the CMO only, stating "NOT VERIFIED - MISMATCH: . Override by CMO logged." handoff: cmo-override-only override: requested_by: CMO two_step_confirm: true log: - timestamp - cmo_identity - reason - mismatched_fields - order_id - item_barcode notify_flight_surgeon: true statement: 'NOT VERIFIED - MISMATCH: . Override by CMO logged.' stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- The fetch stops at once; the robot returns the item to stowage (or to quarantine if a check failed) and tells the CMO. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses; crew care never waits for the link or the robot. Loss of link does not stop this protocol by itself. The robot pauses any movement and tells the CMO; on the CMO's confirmation it continues offline from the local inventory copy and syncs at the next contact. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: Any mismatch, failed scan, failed recipient check, or a check that cannot be done action: >- Hard stop: item sealed in a labeled NOT VERIFIED bag and quarantined. The robot never hands it over unprompted, and never to anyone other than the CMO. Hand-over only on the CMO's two-step override, logged and flagged to the flight surgeon (S7). level: stop refs: - V2 10172 - id: X7 trigger: The order changes during the fetch action: Stop; discard the old order; read back the new one. level: stop - id: X8 trigger: >- A crewmember asks the robot for medicine advice, or anyone other than the CMO asks for a quarantined item, or an override is requested without the two-step confirm and a reason action: Robot declines and routes the request to the CMO or flight surgeon; the item stays in quarantine. level: stop red_flags: - id: RF1 sign: Any field mismatch, including recipient threshold: any action: Hard stop; quarantine; no hand-over unless the CMO makes the logged two-step override; CMO decides - id: RF2 sign: A human-entered allergy or other flag in the crewmember's record threshold: any action: Hard stop; quarantine; CMO and flight surgeon decide - id: RF3 sign: Storage temperature outside limits threshold: beyond action: 'MISMATCH: storage; quarantine; CMO decides' - id: RF4 sign: CMO override hand-over of a NOT VERIFIED item threshold: any action: >- Logged (timestamp, CMO, reason, mismatched fields); flag sent to the flight surgeon at once, or at the next contact if the link is down - id: RF5 sign: Stock below the reorder level threshold: action: Flag to ground for resupply planning safety_limits: - id: L1 name: Hand-over after a mismatch or failed check without a completed, logged CMO two-step override value: not allowed enforced: >- Gripper release to a person is blocked unless all checks passed, or the identified CMO completed the two-step override and the log entry was written refs: - V2 10172 - id: L2 name: Hand-over of a NOT VERIFIED item to anyone other than the CMO value: not allowed enforced: Release requires the CMO's identity check - id: L3 name: Proxy scanning (any label other than the item's own package) value: not allowed enforced: Scanner accepts only the item held in the gripper - id: L4 name: Opening packaging value: not allowed enforced: Gripper task limits - id: L5 name: Gripper force on vials and blister packs value: enforced: Force sensing refs: - V2 10172 - id: L6 name: Sharps (uncapped needles) value: not allowed enforced: Robot refuses items tagged as uncapped sharps - id: L7 name: Time from order to hand-over value: enforced: Logged; crew may fetch directly logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Every fetch, field-by-field result, mismatch, quarantine, CMO decision and inventory change, linked to the order. Every override records the timestamp, CMO identity, reason, mismatched fields, order and item barcode, and when the flight surgeon flag was sent. requirements: - id: V1 3004 use: >- In-mission care includes inventory monitoring and administering and managing all medications (a human capability). - id: V1 3006 use: Two crew medical officers per vehicle for NASA programs (see the commercial-flight note). - id: V1 6003 use: Private medical communications. - id: V1 7001 use: Records kept in retrievable form. - id: V1 7003 use: Secure records. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7052 use: Relocatable items have a dedicated stowage location. - id: V2 7059 use: Inventory system tracks locations and quantities of items. - id: V2 10161 use: Status shown. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Data recorded and shared. - id: V2 10164 use: Shows who acts. - id: V2 10165 use: Human override. - id: V2 10168 use: Human can take over. - id: V2 10170 use: The screen shows each field compared and why it matched or not. - id: V2 10171 use: Robot says when it cannot verify (unreadable code, missing data, identity not confirmed). - id: V2 10172 use: Protective stop. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Simulated inventory with seeded errors (wrong recipient, wrong strength or form, outside the time window, expired, out-of-storage, unreadable code, proxy label). pass: Every seeded error caught; zero false MATCH TO ORDER results; zero hand-overs after a mismatch. - stage: training model what: Mock-up stowage with real packaging and labels. pass: Retrieval success and scan accuracy at or above . - stage: Earth analog what: Analog crews using the robot for routine medicines. pass: Zero unverified hand-overs; overrides reviewed; crew workload not increased. - stage: flight use under flight surgeon supervision what: Inventory checks first, then non-urgent fetches. pass: Inventory accuracy at or above ; no safety events. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by the CMO after a human order. No flight surgeon real-time presence needed; overrides reviewed by the flight surgeon at the next contact. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: the flight surgeon can uplink orders; inventory syncs with the ground.' loss_of_signal: - Only the robot pauses; crew care never waits for the link or the robot. - >- The robot tells the CMO; on the CMO's confirmation it works from the local inventory copy, and the CMO enters orders onboard. - Inventory, logs and overrides sync at the next contact. mars_delay: - All orders are entered onboard; the robot never waits for the ground to match an item to the order. - Inventory, expiry, override and resupply data go to the ground as packages. sources: - key: poon text: >- Poon EG, Keohane CA, Yoon CS, et al. Effect of bar-code technology on the safety of medication administration. N Engl J Med. 2010;362(18):1698-1707. url: https://doi.org/10.1056/NEJMsa0907115 doi: 10.1056/NEJMsa0907115 pmid: '20445181' supports: >- In one hospital before-and-after study, bar-code verification cut non-timing administration errors by 41.4% and related potential adverse drug events (other than those from timing errors) by 50.8%, but did not eliminate errors; timing errors fell, but timing-related potential adverse drug events did not change. - key: koppel text: >- Koppel R, Wetterneck T, Telles JL, Karsh BT. Workarounds to barcode medication administration systems: their occurrences, causes, and threats to patient safety. J Am Med Inform Assoc. 2008;15(4):408-423. url: https://doi.org/10.1197/jamia.M2616 doi: 10.1197/jamia.M2616 pmid: '18436903' supports: >- Barcode medication administration aims to help confirm the five 'rights': right patient, drug, dose, route and time; workarounds (for example unreadable barcodes, or patient ID barcodes stuck to carts or doorframes) undermine it. - key: ismp text: >- Institute for Safe Medication Practices. Lack of proper escalation process for BCMA scanning failures. ISMP Medication Safety Alert! Acute Care, March 21, 2024. url: https://www.ismp.org/sites/default/files/newsletter-issues/20240321.pdf supports: >- Procedures must include an escalation process for barcode scanning failures; unsafe practices include giving a medicine when the barcode will not scan and scanning barcodes from sources other than the medicine itself (proxy scanning). - key: tb006 text: NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmaceuticals.pdf supports: >- Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059]. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: Requirement IDs beginning V1. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-20' version: '0.3' source: >- Protocol-owner decision, Oct 20, 2026, following the reviewer's original suggestion (item 30 of the AI-assisted review) items: - >- After a mismatch or failed scan, the robot may hand the item to the CMO, but only on the CMO's explicit two-step override: the CMO states the override and its reason, then confirms. - >- Each override is logged with the timestamp, CMO identity, reason, mismatched fields, order and item barcode, and flagged to the flight surgeon (at the next contact if the link is down). - 'At hand-over the robot states "NOT VERIFIED - MISMATCH: . Override by CMO logged."' - >- Unchanged default: on any mismatch the item is sealed in the NOT VERIFIED bag and quarantined; the robot never hands it over unprompted, and never to anyone other than the CMO. The ban on "safe" wording stays. - >- The schema and build now allow a hand-over after a mismatch only through a branch marked as a CMO override with the logging and flight surgeon notification fields. - date: '2026-10-20' version: '0.2' source: AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 items: - >- REWORKED. The robot now matches every order field: recipient identity at hand-over, crewmember on the order, medicine, strength, dose form, quantity and ordered time window, plus expiry, storage and record flags (Koppel 2008). - >- Any mismatch, failed scan or failed recipient check is a hard stop with no hand-over: the item is quarantined in a NOT VERIFIED bag; only the CMO may take it out, by hand, logged as an override (ISMP 2024). - >- Result wording is now "MATCH TO ORDER. Not a dose, interaction or allergy review."; "verified safe", "safe to take" and "OK to give" are banned. - >- Expiry and storage problems are shown as MISMATCH before any hand-over; whether to use the item is a human decision (NASA TB-006). - >- Unreadable barcodes: no hand-over; scan-failure escalation; no proxy scanning (ISMP 2024). The second-crewmember check is marked as a design suggestion. - Poon 2010 wording made precise (non-timing errors; did not eliminate errors). - 'X5 link loss: pause, then continue offline on the CMO''s confirmation.' - X1 now stops the fetch (no patient recording in this protocol). - The pharmacy lead is now an allowed placeholder owner in the schema. - >- Version 0.2 sent any mismatched item to quarantine with no hand-over at all (stricter than the reviewer's suggestion); see the v0.3 note above. - >- Loss of link (X5) now means: pause motion, tell the CMO, and continue offline only on the CMO's confirmation (fixes the contradiction with the comms branch). - >- Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build. - date: '2026-10-21' version: '0.3' source: Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49 items: - >- Inherited stop-rule and requirement wording: "holds a safe position" → "holds its stopped position"; "stays in its safe state" → "stays stopped"; "take over safely" → "take over"; "Robot stays safe if no one takes over" → "Robot stays stopped if no one takes over". Schema level name safe-state and never-word list entry "safe" unchanged. - date: '2026-10-21' version: '0.4' source: Batch 6 editorial (AI-assisted), Oct 21, 2026 items: - >- Requirement use for [V2 10173] changed from "Safe default." to "Robot stays stopped if no one takes over." (batch 5 review item 25; editorial, behaviour unchanged). The PHARM-001 mismatch rule is unchanged: quarantine by default, hand-over only on the CMO's explicit two-step request, logged as an override and flagged to the flight surgeon. - date: '2026-10-21' version: '0.5' source: Batch 7 editorial (AI-assisted), Oct 21, 2026 items: - >- Citation labels changed to the site's year-only convention: "(approved for public release )" now reads "(YYYY)", and NASA-STD-3001 Volume 2 "Revision F (approved July 14, 2026)" now reads "(Rev F, 2026)" (sources: v2). Editorial; no change to steps, thresholds or limits. - date: '2026-10-21' version: '0.6' source: Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026 items: - >- X5 and the comms loss-of-signal branch now open with "Only the robot pauses; crew care never waits for the link or the robot." (batch 7 review suggestion 29). Editorial; robot behaviour unchanged. - date: '2026-10-21' version: '0.7' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 8 review), editorial items: - >- Source tb006 now names the document its link serves: NASA Medical Technical Brief OCHMO-MTB-012, Pharmaceutical Care, Rev B (2026); it was cited as OCHMO-TB-006 (2023). The claims cited are unchanged (batch 8 review fix 6). - >- Citation label only; the medication rule (quarantine by default, hand-over only on the CMO's explicit two-step request, logged as an override and flagged to the flight surgeon) is unchanged.