Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My insulin pump controller has a bug

twitter.com

Post reply on HN
Print view View original

151–160 of 172 posts

Re: My insulin pump controller has a bug

#151

Post by jacquesm »

grayhatter wrote: post #148
jacquesm wrote: post #89

Earlier quoted context omitted.

Absolutely. The App should be considered hostile by the pump firmware until proven otherwise.

What you mean to say is completely correct. What you actually said is wrong, there's a huge delta between hostile and unproven. The pump firmware should assert it's own safety and sanity checks. Which is different from hostility.

You are making the assumption that the app is the real app and that the app is under the control of the user. Both may turn out not to be the case so 'hostile' would seem to me to be the only proper classification unless the communications have ways of verifying that either of the above scenarios is not in play. Better safe than sorry with this stuff.

Re: My insulin pump controller has a bug

#152

Post by auggierose »

pciexpgpu wrote: post #138
auggierose wrote: post #82

Earlier quoted context omitted.

For software like that, not sure how anything other than formally proven correct software is acceptable. And note, no type system is gonna help you with a bug like that.

Theory meets practice. An automated theorem proves that knows about Android view hierarchy, Parcelables, Android kernel well really entirety of SELinux not to mention whatever Bluetooth firmware drivers seems quite a bit of boiling the ocean. The actual device (not the app) does seem poorly engineered and not at all fail safe / provided with ‘might kill the patient’ error handling. Seems like double whammy where an a…

In a way you are right, but all that stuff (Android, Parcelables, Android kernel) is garbage. Time to replace all of that with a proper formally proven stack. It's not that Apple or Google don't have the money to do that. They just don't have the will, knowledge and engineers for that.

Re: My insulin pump controller has a bug

#153

Post by fsflover »

onetimeuse92304 wrote: post #117
fsflover wrote: post #69

Earlier quoted context omitted.

> The point is that with commercial software is that there exists an entity There is no reason you can't hire a company to support free software.

You can hire, but no company will take responsibility for it as in be liable in court for damages.

Why is that? Should depend on your pay.

Re: My insulin pump controller has a bug

#154

Post by mlsu »

bradley13 wrote: post #50
deltaburnt wrote: post #39

I'm not familiar with insulin dosing, but I'm guessing a sharp 10x jump should warrant my app telling me to go to the hospital? I'd expect medical devices like this to have a last line of defence safety check against bugs. Basically checking all common sense edge cases like: is this dose lethal to humans, is this dose significantly more/less than historical doses, is this dose below a level in which most humans would…

Good software would certainly include that kind of multi-layered defense. Insulin dosage does not vary by a factor of 100. Sadly, medical software is not written any better than any other software. In this case, the firmware was probably written by engineers who don't think about possible user errors, because they are focused on the hardware. Meanwhile, the app was probably outsourced to the lowest bidder from Elboni…

I can't speak for Omnipod in particular, but insulin pump firmware is absolutely written with user error in mind. There is probably an entire team at the company ("human factors") that will do testing to make sure that the planned UX for the device would not (or, better yet, cannot) be misinterpreted or misused.

Also, other commenters here are insinuating that it's possible to wash your hands of something like this by just putting some text warning like "you should always check the dose before delivery." That is not true, neither for the FDA nor for the internal standards for the manufacturer.

Re: My insulin pump controller has a bug

#155

Post by mlsu »

andreasley wrote: post #6

May be this pump/issue: https://www.tandemdiabetes.com/docs/default-source/legal/com... However, the document states that "there is no defect identified in relation to the use of this product", which would contradict the Twitter post, so maybe it's a different product or either the poster or the document is wrong.

It is not.

Re: My insulin pump controller has a bug

#156

Post by chlorion »

grayhatter wrote: post #148
jacquesm wrote: post #89

Earlier quoted context omitted.

Absolutely. The App should be considered hostile by the pump firmware until proven otherwise.

What you mean to say is completely correct. What you actually said is wrong, there's a huge delta between hostile and unproven. The pump firmware should assert it's own safety and sanity checks. Which is different from hostility.

I think it should assume its hostile since physical harm could be done in the case of someone hijacking the app.

The users phone could be stolen, or the device compromised, or many other things. A compromised device should not be able to cause physical harm to a human!

edit: someone else already said basically the same thing but I didn't see it because I opened this tab a long time ago and didn't refresh it!

Re: My insulin pump controller has a bug

#157

Post by mlsu »

schiffern wrote: post #111
omh wrote: post #33

A clearer description of the bug is here: https://twitter.com/Tims_Pants/status/1730515134731182490 It's wild that this sort of bug got through testing. As a diabetic it feels like our insulin pump software is very conservative and lacking in features especially compared to what some of the "closed loop" things would like to do. That seems reasonable if the manufacturers are having to do lots of safety testing. But i…

The user-blaming stands out in their official communication. Bad sign for company culture. > Once the bolus dose is confirmed and you tap START, the value that is shown on the screen will be delivered by the system... > As stated in our User Guide, it is important to review the bolus amount before you confirm and start the bolus. Omnipod 5 will always deliver the amount you confirm and that is shown on the Confirm Bo…

On the flip side, what behavior would you prefer? The pump to not always deliver the amount you confirm?

I mean, this is clearly a bug, but under normal operation it would be much much worse if the system silently overrode a user dose. People's insulin sensitivity varies a lot. A 350lb person may regularly dose 10 units for a single meal, whereas that dose would kill a small child. If you are 350lbs, and your BG is 400, in DKA, and you're dosing 15 or 20u as a correction, you do not want an automatic early termination of the dose.

You can always cancel a bolus in progress. The override/cancel bolus is likely the highest priority task in the entire system. In the worst case, you can physically disconnect.

Re: My insulin pump controller has a bug

#158

Post by mlsu »

pixl97 wrote: post #97
wwilim wrote: post #72

Earlier quoted context omitted.

If you wanted 0.66 units and got 66 units, I am pretty sure you would die. I would count on the tissue around the infusion site not having enough throughput to release it all into your system at once and swelling up. This would mean the problem would spread over a few hours, but it would be an extreme emergency anyway. To put it into perspective (at least with my insulin to carb ratio, it varies from person to person…

Heh, yea, this is why when I went to DEFCON I disconnected the feed to my body. I mean it's not likely someone's going to try to murder me via bluetooth, but why take the risk when I didn't have to. In the days before I had a pump I did something similar to myself. I had a short acting insulin and long acting insulin both in pen form. Managed to give myself the large overnight dose which should have been the long act…

Why is it always orange juice?

I have had exactly the same experience. One glass of orange juice is great. 3/4 of a gallon.. not so much.

Re: My insulin pump controller has a bug

#159

Post by chlorion »

auggierose wrote: post #82
mtmail wrote: post #2

Non-twitter link: https://nitter.net/morganherlocker/status/173045572181552742... (edit: I'm not the author) "Notified today that my insulin pump controller has a bug where the leading decimal point will be dropped, ie: changing a dose of .21 units to 21 units. I can reproduce randomly ~1 in 5 times so probably a race condition. Easily one of the worst software bugs I have ever heard of."

For software like that, not sure how anything other than formally proven correct software is acceptable. And note, no type system is gonna help you with a bug like that.

I don't know very much about formal methods but I would assume the type system plays an important role for encoding that specific states can or cant exist.

Re: My insulin pump controller has a bug

#160

Post by jacquesm »

chlorion wrote: post #156
grayhatter wrote: post #148

Earlier quoted context omitted.

What you mean to say is completely correct. What you actually said is wrong, there's a huge delta between hostile and unproven. The pump firmware should assert it's own safety and sanity checks. Which is different from hostility.

I think it should assume its hostile since physical harm could be done in the case of someone hijacking the app. The users phone could be stolen, or the device compromised, or many other things. A compromised device should not be able to cause physical harm to a human! edit: someone else already said basically the same thing but I didn't see it because I opened this tab a long time ago and didn't refresh it!

Np, happens to me all the time. I have a ton of tabs open and re-visit them during the day and I always forget to refresh first.
Post reply on HN