Why is there a virus scanner on a PC inside the operating room?
Don't tell me that PC is connected to the internet...
Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
31–40 of 211 posts
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#32/rant/ I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the first questions we now ask when we get a tool-down report is "is there antivirus running and what is the configuration?" Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a mi…
This This machines costs hundreds of thousands of dollars. There should be no excuse for using Windows. None. I would not be surprised if the "antivirus" thing was some PHB requirement
Is there a reason to believe that choosing Windows was a bad decision?
The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not by installing antivirus.
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#33Is it going to take more deaths to convince people to learn from the Therac-25[1]? If you aren't designing for safety first , you have no business working on medical devices or anything else that might be a dangerous when it misbehaves. [1] http://sunnyday.mit.edu/papers/therac.pdf
I am not the parent poster, but may I ask why is this comment being down-voted? I'm not speaking for the parent, but he or she seems to be implying that medical equipment with anti-virus software with automatic updates (used as such) may potentially compromise a patient's safety, and may be indicative of further bad design practices, which could result in, at worst, death. Is this somehow off-topic, or not worthy of discussion?
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#34Earlier quoted context omitted.
"Cheaper" or "remain within the budget" doesn't excuse using inadequate parts that don't meet the design requirements. Unfortunately, this total disregard for safety isn't just software anymore. When we stat skipping lessons that we've know for a looooooonng time (such as why a split bobbin is an important feature in a transformer[1]), we have evidence of a serious need for strongly enforced regulation. [1] https://n…
I know it doesn't, but unfortunately it is often how it works. More than I want to remember I have seen things like 'but lives depend on this!' or '100s of millions can get lost if this doesn't work!' and yet when the RFPs come back and something like InfoSys is chosen because big name and cheaper than experts in the field. Edit; > we have evidence of a serious need for strongly enforced regulation. Better education?…
Better education is always a great idea. Unfortunately, regulation becomes a necessary fix for immediate problems.
Note that regulation is the nicer option; the other way to force people to get the necessary education is liability, which could get really ugly in the case of medical devices.
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#35Earlier quoted context omitted.
correlation doesn't imply causation.... except when someone selected windows, and then made 50 other moronic decisions also. half the work done in this industry is just dealing with stupid decisions made by stupid people. i just accept this now.
But when Windows is chosen because it is easier to find coders who will 'remain within the budget' (cheapcheap) and cannot even make sure the virus scanner doesn't run during procedures or at all it goes a bit too far.
According to the article, it was the hospital IT that misconfigured the antivirus, not the application developers.
Is there some reason to believe this wouldn't occur on a Linux system? There are plenty of dumb IA requirements that antivirus be installed on Linux, too.
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#36Earlier quoted context omitted.
This This machines costs hundreds of thousands of dollars. There should be no excuse for using Windows. None. I would not be surprised if the "antivirus" thing was some PHB requirement
Is there a reason to believe that choosing Windows was a bad decision? The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not…
You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network)
And I would have followed the same steps you mentioned. The machine could work with Windows.
Windows CE might have been a better pick, so you can have things like RO filesystem, etc
"There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since they do it the lazy way, it is awful. Not sure if there's an out-of-the-box way of firewalling everything in the Windows versions available at the time that machine was built
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#37I worked at a financial company that ran its production Oracle database servers on Windows in the same network as the staff (no firewall) and ran virus checkers on them. Performance was terrible of course.
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#38Earlier quoted context omitted.
I would expect these kinds of systems to be running a soft realtime OS. Or at the very least a run of the mill OS with no extraneous software running in the background.
This. How are these devices not running on some sort of hardened OS seen in airplanes and automotive? Medical applications are mission critical (or some variant) and should have same (or better!) certification procedures set up for correctness and security.
Second this. It is terrifying to know that mission critical, medical grade software runs on a consumer operating system. Military/aerospace systems have numerous requirements and clearly defined practices and ways of developing these systems, often going through various layers of documentation and using specifically designed programming languages(like the Z programming language) to write specifications, which are then re-written into code, but it seems like medical industry has been neglected.
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#39Earlier quoted context omitted.
I know it doesn't, but unfortunately it is often how it works. More than I want to remember I have seen things like 'but lives depend on this!' or '100s of millions can get lost if this doesn't work!' and yet when the RFPs come back and something like InfoSys is chosen because big name and cheaper than experts in the field. Edit; > we have evidence of a serious need for strongly enforced regulation. Better education?…
Better education is always a great idea. Unfortunately, regulation becomes a necessary fix for immediate problems. Note that regulation is the nicer option; the other way to force people to get the necessary education is liability , which could get really ugly in the case of medical devices.
There have been 'predictions' in the past of software creators being made responsible for the software they write in a liability way. Which will get very messy indeed. And grind the software world to a halt. Regulation is the nicer option and definitely the more realistic option.
Re: Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan
#40Earlier quoted context omitted.
Is there a reason to believe that choosing Windows was a bad decision? The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not…
You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network) And I would have followed the same steps you mentioned. The machine could work with Windows. Windows CE might have been a better pick, so you can have things like RO filesystem, etc "There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since…
A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program."
I wish I was kidding.