RMP-PHARM-004 Controlled-medicine count with a crewmember: a blind two-person count, comparison with the inventory record and a private discrepancy flag (no hand-over)

1 · Identity and scope

On the CMO's command, or when the CMO accepts the on-screen prompt at the count times the pharmacy lead and flight surgeon set (for example each crew handover), the CMO opens the controlled-medicine store with a second crewmember present as witness. Each of them counts each item without seeing the record count (a blind count) and states it; the robot scans each label as it is shown, logs both counts word for word, and only then compares them with each other and with the RMP-PHARM-001 inventory record field by field. Anything that does not match is quarantined by default exactly as in RMP-PHARM-001 and flagged privately to the flight surgeon and the pharmacy lead. The robot never names or suggests who might be responsible.

Why this protocol was chosen. Hospital guidance has two authorized health care workers count controlled substances held outside automated cabinets at each shift change, and identifies and investigates discrepancies promptly (ASHP 2022, used by analogy). NASA tracks the location and quantity of medicines (V2 7059), and long missions make inventory control more important (OCHMO-MTB-012). The robot is not a second counter: two humans count, and the robot logs, compares and flags. The RMP-PHARM-001 rule applies unchanged: a mismatch is quarantined by default, handed over only on the CMO's explicit two-step request inside RMP-PHARM-001, logged as an override and flagged to the flight surgeon. The blind count, the count times and the private flag are design judgment. Open question for review: whether the count needs a second trained CMO as witness, or any crewmember.

Autonomy: Max rung 2: on the CMO's command or an accepted schedule prompt, the robot logs a count that two humans make (the CMO and a second crewmember as witness), scans labels without touching any pack, compares the counts with the RMP-PHARM-001 inventory record and flags any discrepancy privately. The robot is never the second counter, never opens the controlled store and never holds, takes or hands over any medicine. The RMP-PHARM-001 rules apply unchanged.

Related: RMP-PHARM-001 · RMP-PHARM-002 · RMP-PHARM-003 · RMP-BEH-002

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Second trained CMO: receives every alert and flag and takes over if the CMO is unavailable
• Witness: a second crewmember who counts independently
• Pharmacy lead (ground): investigates discrepancies and decides record corrections

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [9]

3 · Preconditions and consent

• PRE-1 The CMO started the count by command or accepted the scheduled prompt on screen, and a second crewmember is present as witness; no URGENT alert, emergency protocol or cabin alarm is active.human_start == trueV2 10174
• PRE-2 Robot self-test passed; kit stowage locations known.V2 10161V2 7059
• PRE-3 Robot and supplies restrained when not moving.V2 7046
• PRE-4 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]

Consent

The count involves no crewmember's body; the CMO and the witness agree to their names and counts being logged.

Emergency consent

A count stops at once for any emergency; the store stays open to the crew for emergency use.

Withdrawal

The CMO can stop a count at any time; items not counted are listed as "not counted".

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   Tell the flight surgeon, the CMO and the pharmacy lead that a controlled-medicine count has started, with who is counting (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

   Done when: Notice logged.

   V1 3006V2 10174

   D1DecisionRobot decides

   Is a second crewmember present to count as witness?

   • Yes → Continue.
   • No → The count does not start: log "CANNOT VERIFY: no witness" and tell the CMO; the robot is never the second counter. No hand-over.No hand-over
2. S2Crew

   The CMO opens the controlled store with the witness present. The CMO and the witness each count each item without seeing the record count, and enter their count privately on their own screen; no count is spoken, and neither count nor the record count is shown until both are entered; the CMO holds up each pack label to the scanner.

   Done when: Both counts stated for each item.

   V2 7059

3. S3RobotRung 2

   Scan each label as the CMO shows it, without touching any pack, and log each count as entered, with who entered it. Show no count and no record count for an item until both counts for it are entered.

   Done when: Labels scanned; both counts logged.

   V2 7059

   D2DecisionRobot decides

   Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?

   • Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
   • No → Continue.
4. S4RobotRung 2

   Compare the two counts with each other and with the inventory record field by field (medicine, strength, form, quantity, lot, printed expiry, location). Show "COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review." only when both counts and every field match; otherwise show MISMATCH or CANNOT VERIFY with the fields named. Show the date as "printed expiry: <date>".

   Done when: Each item shown with its result.

   V2 7059

   D3DecisionRobot decides

   Did both counts and every inventory field match the record for this item?

   • Yes → Record "COUNTS MATCH THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review." and continue to the next item.
   • No, or a check could not be done → HARD STOP for that item. Show MISMATCH or CANNOT VERIFY with the fields named (for example the two counts differ, a count differs from the record, the lot or location differs, a tamper seal is broken, or a label is unreadable). The item is quarantined by default, as in RMP-PHARM-001: the CMO, with the witness present, seals it in a labelled NOT VERIFIED bag in the quarantine section of the controlled store, and the robot records it. No hand-over. An item leaves quarantine only inside RMP-PHARM-001, on a real order, through its unchanged two-step CMO override (logged as an override and flagged to the flight surgeon). A record correction fixes the record only and never takes an item out of quarantine.No hand-over
   • A record correction that the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact), never the CMO alone and never the robot, entered in two steps: by the pharmacy lead from the ground, or, with the link down, by the CMO and the witness together (two people, neither stating for the other), flagged, and reviewed by the pharmacy lead at the next contact → Record correction only. No hand-over: the robot reads back the fields to change, updates the record when the second step confirms it, flags the correction to the flight surgeon at once (queued if the link is down), and logs a recount by the CMO and the witness against the corrected record. Any use of the item goes only through RMP-PHARM-001 on a real order. The correction fixes the record only: the item stays quarantined.No hand-over
   • Anyone asks the robot for a quarantined item → No hand-over in this protocol. The robot says that a quarantined item leaves quarantine only inside RMP-PHARM-001, on a real order, through its two-step CMO override, and logs the request.No hand-over
5. S5Crew

   For each MISMATCH or CANNOT VERIFY, the CMO, with the witness present, seals the item in a labelled NOT VERIFIED bag in the quarantine section of the controlled store, then closes and reseals the store and states the new seal number.

   Done when: Items quarantined; store resealed.

   V2 7059

6. S6RobotRung 2

   Record each quarantine and the new seal number as stated, and update the inventory record status to NOT VERIFIED for those items. The robot never holds, takes or hands over anything.

   Done when: Record updated.

   V2 7059

7. S7RobotRung 2

   After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

   Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

   V2 10173V1 3006

8. S8Ground

   The pharmacy lead and flight surgeon investigate each discrepancy, and the pharmacy lead decides (with the link down, the CMO and the witness under the onboard checklist, reviewed by the pharmacy lead at the next contact) any record correction. A correction is never decided by the CMO alone or by the robot.

   Done when: Decisions logged.

   V1 3004

   D5DecisionGround decides

   What happens to each quarantined item, and is a record correction needed?

   • Link live → Flight surgeon decides; robot logs.
   • Link down or delay too long → The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact.
9. S9RobotRung 2

   Send one private report to the flight surgeon and the pharmacy lead (and the CMO): items counted, both counts, each result, quarantined items and the seal number; it names only the counters, never anyone as responsible.

   Done when: Report delivered or queued; acknowledged.

   V1 6003V1 7003

   D4DecisionRobot decides

   Did the flight surgeon or the CMO acknowledge the report within <set by validation> minutes?

   • Yes → Log the acknowledgement.
   • No response → URGENT: log "no response" (never "declined"); the report goes to the second trained CMO, or the next named crewmember, who checks on the CMO in person.

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Each item counted: both counts with who stated them, the label scan, the result, any quarantine and time; the store seal number before and after; every record correction (timestamp, CMO identity, reason, mismatched fields, item barcode, pharmacy lead decision) and its flight-surgeon flag. Reports name only the counters.V2 7059
• LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [4] and Volume 2 Revision F [5]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Seeded counts with the two counts differing, a count lower than the record, a broken seal, no witness, a request for a quarantined item, an alarm mid-count. Pass: Every discrepancy quarantined and flagged privately; zero hand-overs; zero counts without a witness; zero record counts shown before both counts.
2. Training model. Count of a mock controlled store. Pass: Count completed without the robot touching a pack.
3. Parabolic or station demonstration. Label scanning in weightlessness. Pass: Every pack scanned or listed.
4. Flight use under flight surgeon supervision. First counts alongside the crew's paper count. Pass: Agreement with the paper count; no unflagged discrepancy.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by the CMO or an accepted schedule prompt, with a witness present. Two humans count; the pharmacy lead and flight surgeon decide every discrepancy.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.3.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [8].

Loss of signal and Mars delay

Live link

Low Earth orbit: the pharmacy lead and flight surgeon receive the report when the link allows.

Loss of signal

• Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation.
• Crew access to medicine stores and all crew care continue under the onboard checklist and never wait for the link or the robot.
• The robot works from the local record copy; quarantine stands without the ground.

Mars-class delay

• Count times are set before flight; the CMO decides on quarantined items under the onboard checklist.

[7]

Sources

1. American Society of Health-System Pharmacists. ASHP Guidelines on Preventing Diversion of Controlled Substances. Am J Health-Syst Pharm. 2022;79(24):2279-2306. doi:10.1093/ajhp/zxac246 Supports: Controlled-substance storage areas outside automated cabinets are inventoried at each shift change by two authorized health care workers; discrepancies are identified, resolved and investigated in a timely way, with discrepancy reports reviewed. Hospital context, used by analogy for a two-person count on board. Read Oct 21, 2026 (saved copy in src/b12).
2. NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmac… Supports: Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059].
3. National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022). www.nice.org.uk/guidance/ng225/chapter/Recommendations Supports: Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm, or to decide who is offered treatment.
4. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7003.
5. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 7055, V2 7059, and Section 10.6 automated and robotic systems.
6. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
7. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
8. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
9. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.