4 ms·

It sounds like the bug was in the Android app. Shouldn't the microcontroller (on the pump) be validating dose values received? (dose > MAX_DOSE) ? return DOSE_

by e2le 3y ago

It sounds like the bug was in the Android app. Shouldn't the microcontroller (on the pump) be validating dose values received? (dose > MAX_DOSE) ? return DOSE_TOO_HIGH : return DOSE_ACCEPTED; 20 units is obviously dangerous for a single dose.

jacquesm 3y ago
Absolutely. The App should be considered hostile by the pump firmware until proven otherwise.
- patagurbon 3y ago
  This is quite the overreaction. There is both a confirmation screen and a maximum bolus setting to ameliorate the issue until an OTA update can be provided. Stranding users who use the app without access to our lifesaving medical device is... Bold, to say the least.
  - jacquesm 3y ago
    If you are a diabetic you should always have a plan B for your 'lifesaving medical device' because they can break. For instance: https://www.northwoodsendocrinology.com/wp-content/uploads/2018/10/Insulin-Pump-Back-Up-Plan.pdf https://www.northwoodsendocrinology.com/wp-content/uploads/2... Presumably whoever provided you your pump has a similar instruction. Risking using an app/pump combo that has a known flaw, especially a non-deterministic one is bold, to say the least. Safer to switch to the regular controller (assuming you have it) until this is fixed.
- grayhatter 3y ago
  What you mean to say is completely correct. What you actually said is wrong, there's a huge delta between hostile and unproven. The pump firmware should assert it's own safety and sanity checks. Which is different from hostility.
  - jacquesm 3y ago
    You are making the assumption that the app is the real app and that the app is under the control of the user. Both may turn out not to be the case so 'hostile' would seem to me to be the only proper classification unless the communications have ways of verifying that either of the above scenarios is not in play. Better safe than sorry with this stuff.
  - chlorion 3y ago
    I think it should assume its hostile since physical harm could be done in the case of someone hijacking the app. The users phone could be stolen, or the device compromised, or many other things. A compromised device should not be able to cause physical harm to a human! edit: someone else already said basically the same thing but I didn't see it because I opened this tab a long time ago and didn't refresh it!
    - jacquesm 3y ago
      Np, happens to me all the time. I have a ton of tabs open and re-visit them during the day and I always forget to refresh first.
patagurbon 3y ago
There is a max dose but it is a user setting. Mine is set to 25, since I would take about 20 if I ate a few slices of pizza for instance.
jrh3 3y ago
My same thought, Max Dose in an hour setting should prevent severe hypoglycemia as a fail safe, but I did not see anything mentioned in the article about that on Insulet website. My son has this model but we use controller that comes with it, not the Android app, which is where the issue is. Closed loop OmniPod 5/Dexcomm is a game changer for Type 1 management. As a software developer I worry about this sort of thing but hopefully max dose fail safe gets this.

by e2le 3y ago

jacquesm 3y ago

Absolutely. The App should be considered hostile by the pump firmware until proven otherwise.

patagurbon 3y ago
This is quite the overreaction. There is both a confirmation screen and a maximum bolus setting to ameliorate the issue until an OTA update can be provided. Stranding users who use the app without access to our lifesaving medical device is... Bold, to say the least.
- jacquesm 3y ago
  If you are a diabetic you should always have a plan B for your 'lifesaving medical device' because they can break. For instance: https://www.northwoodsendocrinology.com/wp-content/uploads/2018/10/Insulin-Pump-Back-Up-Plan.pdf https://www.northwoodsendocrinology.com/wp-content/uploads/2... Presumably whoever provided you your pump has a similar instruction. Risking using an app/pump combo that has a known flaw, especially a non-deterministic one is bold, to say the least. Safer to switch to the regular controller (assuming you have it) until this is fixed.
grayhatter 3y ago
What you mean to say is completely correct. What you actually said is wrong, there's a huge delta between hostile and unproven. The pump firmware should assert it's own safety and sanity checks. Which is different from hostility.
- jacquesm 3y ago
  You are making the assumption that the app is the real app and that the app is under the control of the user. Both may turn out not to be the case so 'hostile' would seem to me to be the only proper classification unless the communications have ways of verifying that either of the above scenarios is not in play. Better safe than sorry with this stuff.
- chlorion 3y ago
  I think it should assume its hostile since physical harm could be done in the case of someone hijacking the app. The users phone could be stolen, or the device compromised, or many other things. A compromised device should not be able to cause physical harm to a human! edit: someone else already said basically the same thing but I didn't see it because I opened this tab a long time ago and didn't refresh it!
  - jacquesm 3y ago
    Np, happens to me all the time. I have a ton of tabs open and re-visit them during the day and I always forget to refresh first.

patagurbon 3y ago

There is a max dose but it is a user setting. Mine is set to 25, since I would take about 20 if I ate a few slices of pizza for instance.

jrh3 3y ago

My same thought, Max Dose in an hour setting should prevent severe hypoglycemia as a fail safe, but I did not see anything mentioned in the article about that on Insulet website. My son has this model but we use controller that comes with it, not the Android app, which is where the issue is. Closed loop OmniPod 5/Dexcomm is a game changer for Type 1 management. As a software developer I worry about this sort of thing but hopefully max dose fail safe gets this.