Hi medical software researcher / professor here. This is definitely a bad bug! I’d like to use it as a teaching example — any chance you could post a video of the bug? Especially one that shows how it sometimes takes the value correctly and sometimes changes it?
My insulin pump controller has a bug
161–170 of 172 posts
Re: My insulin pump controller has a bug
#162This is the Omnipod 5 when using the Android app as the controller. I received the email this morning. This is indeed a pretty terrible bug. I'm hopeful the confirmation screen prevented any real harm from being done. E: I can reproduce. It seems to happen around 1 in 10 entries for me.
Do you know what version of the app you have? I've not been able to reproduce it yet on 1.0.91 (Following the steps as I saw at https://twitter.com/Tims_Pants/status/1730515134731182490)
Re: My insulin pump controller has a bug
#163Earlier quoted context omitted.
The user-blaming stands out in their official communication. Bad sign for company culture. > Once the bolus dose is confirmed and you tap START, the value that is shown on the screen will be delivered by the system... > As stated in our User Guide, it is important to review the bolus amount before you confirm and start the bolus. Omnipod 5 will always deliver the amount you confirm and that is shown on the Confirm Bo…
On the flip side, what behavior would you prefer? The pump to not always deliver the amount you confirm? I mean, this is clearly a bug, but under normal operation it would be much much worse if the system silently overrode a user dose. People's insulin sensitivity varies a lot. A 350lb person may regularly dose 10 units for a single meal, whereas that dose would kill a small child. If you are 350lbs, and your BG is 4…
> On the flip side, what behavior would you prefer?
Personally I want a (mandated) hardware Emergency Stop button, like any other machine with potential to malfunction dangerously.
A button needs protection from accidental activation, but fortunately that's a solved problem.
> You can always cancel a bolus in progress.
I sincerely hope that's true, but the documentation makes the intended behavior very unclear.
Re: My insulin pump controller has a bug
#164Earlier quoted context omitted.
For software like that, not sure how anything other than formally proven correct software is acceptable. And note, no type system is gonna help you with a bug like that.
I don't know very much about formal methods but I would assume the type system plays an important role for encoding that specific states can or cant exist.
But a high reading is a state that can exist. I don’t really see how formal methods would exclude a multiplication/unit error with respect to the displayed unit.
Re: My insulin pump controller has a bug
#165Earlier quoted context omitted.
The user-blaming stands out in their official communication. Bad sign for company culture. > Once the bolus dose is confirmed and you tap START, the value that is shown on the screen will be delivered by the system... > As stated in our User Guide, it is important to review the bolus amount before you confirm and start the bolus. Omnipod 5 will always deliver the amount you confirm and that is shown on the Confirm Bo…
You can pop the pump off on a moment's notice (there is a needle sticking out of the pod at the back, some other manufacturers use an umbillical that can be disconnected). Totally agreed on the communications failure here, they all but blame the user for not noticing their error. That's not how a responsible medical device manufacturer should deal with this.
Thanks, good to know. That's something at least!
Re: My insulin pump controller has a bug
#166I can't comprehend how that kind of bug even happens. Not that insulin pumps should have any bugs, but it doesn't even sound like an integer overflow or use after free which is "understandable". Are they doing some kind of scuffed string parsing?
People think it's a race condition. Not knowing anything about this or having seen the UI, I would guess it's something really dumb.
Like maybe every number is sent as it's own Bluetooth packet, but then when you hit enter, that's when the point gets appended.
Because of some other insanity that needed this as a workaround, like, I don't know, maybe it starts out already showing a dot, and the numbers you type go after that, and for some reason they
....and then the Bluetooth stack reorders the enter key and the dot?
Or, maybe the command is sent with the decimal at the end, I'm a packet with other stuff, and the packet length can vary based on the other stuff, and the calculation is wrong.
Or it's even more like Therac, and they have two modes, a 10x and 1x mode, maybe because there's some hardware interlock on the 10x, but they both interpret the value differently and use different units , and there's some bug in selection logic?
Re: My insulin pump controller has a bug
#167Earlier quoted context omitted.
You can pop the pump off on a moment's notice (there is a needle sticking out of the pod at the back, some other manufacturers use an umbillical that can be disconnected). Totally agreed on the communications failure here, they all but blame the user for not noticing their error. That's not how a responsible medical device manufacturer should deal with this.
Thanks, good to know. That's something at least!
These wearable pumps, especially in combination with closed loop are a very interesting and important medical development that can improve quality of life for a huge number of people, but these sort of fuck-ups are really concerning. Inexcusable, especially because they have failed on multiple layers (code review, automated testing, acceptance testing, firmware development). Shocking, really and it makes me wonder wtf is going on at that company software development wise.
Re: My insulin pump controller has a bug
#168I can't comprehend how that kind of bug even happens. Not that insulin pumps should have any bugs, but it doesn't even sound like an integer overflow or use after free which is "understandable". Are they doing some kind of scuffed string parsing?
They probably wrote the controller in JavaScript
It's probably caused by a shitty spec instead of bug. Some PM insists that you must sanitize the user input 'when' user inputs. And '.' alone isn't a proper number. Which led you to this. No. You should NEVER change user input when user action is not finished yet. That's a giant UX hazard.
Re: My insulin pump controller has a bug
#169Earlier quoted context omitted.
I am bad at reading this, can you elaborate what you mean? Should we open source life critical software?
We should: https://news.ycombinator.com/item?id=38143180
Oh good! I agree, perhaps some of it can be defined as a social good. I remember the idea that was posed of having government created social media. Something open source and with a transparent algorithm. I really can't see a downside if it's done well.
Re: My insulin pump controller has a bug
#170Earlier quoted context omitted.
Why do so many people / companies insist on using grossly euphemistic managerspeak like this?
Because it works. People who don't will not get to keep their jobs in corporate environments, even when nothing is going on.
I work in a corporate environment and I refuse to use managerspeak. I haven't lost my job.