CoChat
Sign Up
Cited by 61Safety Systems Engineering in AutonomyPatient Safety and Medication ErrorsRisk and Safety Analysis

A Hazard Analysis for a Generic Insulin Infusion Pump

Open access
Zhang, Yi, Jones, Paul L., Jetley, Raoul·2010·Journal of Diabetes Science and Technology
DOI 10.1177/193229681000400207PMC PMC2864162
Open this paper in CoChat — free accountOpen PDF

Abstract

Background: Researchers at the Food and Drug Administration (FDA)/Center for Device and Radiological Health/Office of Science and Engineering Laboratories have been exploring the concept of model-based engineering as a means for improving the quality of medical device software. Insulin pumps were chosen as a research subject because their design provides the desired degree of research complexity and these types of devices present an ongoing regulatory challenge. Methods: Insulin pump hazards and their contributing factors are considered in the context of a highly abstract generic insulin infusion pump (GIIP) model. Hazards were identified by consulting with manufacturers, pump users, and clinicians; by reviewing national and international standards and adverse event reports collected by the FDA; and from workshops sponsored by Diabetes Technology Society. This information has been consolidated in tabular form to facilitate further community analysis and discussion. Results: A generic insulin infusion pump model architecture has been established. A fairly comprehensive hazard analysis document, corresponding to the GIIP model, is presented in this article. Conclusions: We believe that this work represents the genesis of an insulin pump safety reference standard upon which future insulin pump designs can be based to help ensure a basic level of safety. More interaction with the diabetes community is needed to assure the quality of this safety modeling process.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper presents a generic insulin infusion pump (GIIP) architecture and a preliminary hazard analysis (PHA) that catalogs hazardous situations and causal factors for software-driven personal insulin pumps. It aims to seed a community safety reference model/standard, while noting the analysis is not exhaustive.

Key findings

  • The GIIP model comprises the pump, user, infusion set, and environment; it focuses on software-driven functionality and assumes four programmable insulin administration types: basal, temporary basal, normal bolus, and extended bolus.
  • Overdose and underdose are identified as the most likely hazardous situations, leading to hypoglycemia or hyperglycemia, respectively; hazards are broadly categorized as therapeutic, energetic, biological/chemical, mechanical, and environmental.
  • PHA tables (Tables 2–9) organize causes by operational, software, hardware, physical, electrical, biological/chemical, use, and environmental sources, with each row linking a primary cause, hazardous situation(s), and contributing factors.
  • The FDA MAUDE database indicated over 5000 adverse events reported for insulin pumps in 2008; the analysis draws on manufacturers, pump users, clinicians, FDA adverse event reports, Diabetes Technology Society workshops, and ISO 14971.

Methods

  • Preliminary hazard analysis (PHA) for a highly abstract GIIP model, based on four information sources: domain knowledge from manufacturers, pump users, and clinicians; FDA adverse event reports; Diabetes Technology Society workshops; and ISO 14971.
  • Scope: “standard” electronic personal-use insulin pumps with infusion sets only; excludes hospital or implanted pumps, embedded glucose meters, built-in infusion sets, remote controllers, and accessories; hardware issues are raised only in the broadest sense.
  • Hazards were consolidated in tabular causal-tree form (Tables 1–9), establishing cause-effect relations and contributing factors; no fault tree analysis or HAZOP was performed.

Limitations

  • The paper states the hazard analysis is not exhaustive; in-depth fault tree analysis and hazard and operability analysis remain to be performed, and a compendium of use cases is needed to challenge the model architecture and component interaction.
  • The paper states no single device currently on the market likely has all modeled design features; the model is abstract with no concrete hardware, human factors cause 8.10.13 is a placeholder not elaborated, and mobility conditions addressed are not exhaustive.
  • Evident from the text: the PHA is preliminary and based on abstraction and domain input rather than empirical validation or a completed consensus standard; the authors call for more interaction with the diabetes community to assure the quality of the safety modeling process.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1177/193229681000400207

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 5 cited sources checked · 0 supported · 0 flagged

  • Findingnone given

    Fatigued/worn/broken mechanical parts are a source of hazardous situations for a generic insulin infusion pump.

    “4.2.4Fatigued/worn/broken mechanical parts”
    Quote in the paperSubstantial claim
  • Findingnone given

    Pump overheats while running is a source of hazardous situations for a generic insulin infusion pump.

    “5.4 Pump overheats while running”
    Quote in the paperNot a substantial claim
  • Findingnone given

    Read-only memory or external flash memory failure is a source of hazardous situations for a generic insulin infusion pump.

    “4.1.3Read-only memory or external flash memory failure”
    Quote in the paperNot a substantial claim
  • Findingnone given

    Data logging/retrieval failure is a hazardous situation for a generic insulin infusion pump.

    “3.11 Data logging/retrieval failure”
    Quote in the paperNot a substantial claim
  • Findingnone given

    User fails to replace consumed pump supplies, including insulin and batteries, in time is a source of hazardous situations for a generic insulin infusion pump.

    “8.8 User fails to replace consumed pump supplies, including insulin and batteries, in time”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. 85
  • The quote only partly states this claim. 22
  • May combine two claims. 7

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Battery depletes rapidly, giving the user insufficient time to respond is a source of hazardous situations for a generic insulin infusion pump.

    “6.5.2Battery depletes rapidly, giving the user insufficient time to respond”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Voltage level of the battery varies greatly is a source of hazardous situations for a generic insulin infusion pump.

    “6.5.4Voltage level of the battery varies greatly”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Findingnone given

    Hospital use insulin pumps or implanted insulin pumps are not considered in this work.

    “Hospital use insulin pumps or implanted insulin pumps are not considered in this work.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Battery impedance or contact impedance becomes too high is a source of hazardous situations for a generic insulin infusion pump.

    “6.5.7 Battery impedance or contact impedance becomes too high”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    The authors introduced a bolus calculator subcomponent as part of the pump controller to draw attention to the safety critical nature of bolus recommendation.

    “We have introduced a bolus calculator subcomponent as part of the pump controller to help draw proper attention to the safety critical nature of this function.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Depleted batteries are discarded without being recycled is a source of hazardous situations for a generic insulin infusion pump.

    “6.5.8Depleted batteries are discarded without being recycled”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingnone given

    Pump controller fails to detect mechanism failures of pump delivery is a hazardous situation for a generic insulin infusion pump.

    “3.4 Pump controller fails to detect mechanism failures of pump delivery”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Drug reservoir becomes empty during insulin delivery without the user's awareness is a hazardous situation for a generic insulin infusion pump.

    “2.9 Drug reservoir becomes empty during insulin delivery without the user's awareness”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    The GIIP model is composed of various abstract functional components consistent with the stated scope.

    “The GIIP model is composed of various abstract functional components consistent with the stated scope.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    Pump is disconnected from the infusion set without the user's awareness is a hazardous situation for a generic insulin infusion pump.

    “2.4 Pump is disconnected from the infusion set without the user's awareness”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Occlusion without the user's awareness is a hazardous situation for a generic insulin infusion pump.

    “2.6 Occlusion without the user's awareness”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingnone given

    User provides incorrect parameters to the bolus calculator is a source of hazardous situations for a generic insulin infusion pump.

    “8.9.5 User provides incorrect parameters to the bolus calculator.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Pump fails to auto-stop upon detecting a critical failing condition that requires it to stop is a hazardous situation for a generic insulin infusion pump.

    “3.13 Pump fails to auto-stop upon detecting a critical failing condition that requires it to stop”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Inappropriate bolus is recommended by the bolus calculator and then accepted by the user is a hazardous situation for a generic insulin infusion pump.

    “3.1 Inappropriate bolus is recommended by the bolus calculator and then accepted by the user”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Air pressure within the pump is much lower/higher than ambient air pressure is a source of hazardous situations for a generic insulin infusion pump.

    “5.3 Air pressure within the pump is much lower/higher than ambient air pressure”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User injects long-acting insulin shortly before first use of the pump, causing an amount of insulin on board that cannot be accounted for by the pump is a source of hazardous situations for a generic insulin infusion pump.

    “8.3 User injects long-acting insulin shortly before first use of the pump, causing an amount of insulin on board that cannot be accounted for by the pump”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Excessive bolus administration due to too many bolus requests from the user is a hazardous situation for a generic insulin infusion pump.

    “2.5 Excessive bolus administration due to too many bolus requests from the user”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    User enters incorrect parameters when programming temporary basal deliveries is a source of hazardous situations for a generic insulin infusion pump.

    “8.9.3 User enters incorrect parameters when programming temporary basal deliveries”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    The GIIP system boundary comprises the GIIP (pump), the user, the infusion set (connection), and the environment.

    “We have established a system boundary for our insulin pump model as depicted in Figure 1-it comprises the GIIP (pump), the user, the infusion set (connection), and the environment.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Pump hardware is not initialized properly is a hazardous situation for a generic insulin infusion pump.

    “2.16 Pump hardware is not initialized properly”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    The GIIP administers insulin to the user via a delivery path composed of a drug reservoir, a drug delivery interface, and the infusion set.

    “The GIIP administers insulin to the user via a delivery path, composed of a drug reservoir, a drug delivery interface, and the infusion set.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    A replaceable drug reservoir is detached during normal pump use is a hazardous situation for a generic insulin infusion pump.

    “2.13 A replaceable drug reservoir is detached during normal pump use”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Insulin, while being delivered to the user, loses its potency is a source of hazardous situations for a generic insulin infusion pump.

    “7.5 Insulin, while being delivered to the user, loses its potency”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    The presence of air bubbles can be caused by design defects, manufacturing flaws, device failures, misconnections, and use errors.

    “The presence of air bubbles can be caused by many factors, such as design defects, manufacturing flaws, device failures, misconnections, and use errors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Findingnone given

    Other hardware issues are a source of hazardous situations for a generic insulin infusion pump.

    “4.6 Other hardware issues”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Pump is made of materials that cause user allergic reactions is a source of hazardous situations for a generic insulin infusion pump.

    “7.6 Pump is made of materials that cause user allergic reactions”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingnone given

    Pump controller fails to monitor the status of the pump delivery mechanism is a hazardous situation for a generic insulin infusion pump.

    “3.3 Pump controller fails to monitor the status of the pump delivery mechanism”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingown data

    Sensors and watchdog issues are a source of hazardous situations for a generic insulin infusion pump.

    “4.5 Sensors and watchdog a issues”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingnone given

    Pump housing issues are a source of hazardous situations for a generic insulin infusion pump.

    “4.4 Pump housing issues”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    The GIIP model is an abstraction of real-world insulin pumps, encapsulating common design features.

    “The model is an abstraction of real-world insulin pumps, encapsulating common design features.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Excessive flow rate fluctuation is a hazardous situation for a generic insulin infusion pump.

    “2.12 Excessive flow rate fluctuation”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Leakage current on the surface of the pump is a source of hazardous situations for a generic insulin infusion pump.

    “6.4 Leakage current on the surface of the pump”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    The GIIP model has no concrete notion of hardware.

    “Hardware issues are raised in only the broadest sense because our insulin pump model has no concrete notion of hardware.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    Incorrect critical data is a hazardous situation for a generic insulin infusion pump.

    “3.7 Incorrect critical data.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Pump annunciates notifications of different importance to the user with similar signals is a hazardous situation for a generic insulin infusion pump.

    “3.5 Pump annunciates notifications of different importance to the user with similar signals”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Pump develops excessive static charge or experiences ESD that exceeds its ESD immunity is a source of hazardous situations for a generic insulin infusion pump.

    “6.3 Pump develops excessive static charge or experiences ESD that exceeds its ESD immunity”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    User uses the pump when certain physical/mental conditions such as impaired vision prevent him/her to do so is a source of hazardous situations for a generic insulin infusion pump.

    “8.1 User uses the pump when certain physical/mental conditions such as impaired vision prevent him/her to do so”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Insulin level in the drug reservoir becomes low during insulin delivery without the user's awareness is a hazardous situation for a generic insulin infusion pump.

    “2.10 Insulin level in the drug reservoir becomes low during insulin delivery without the user's awareness”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    Overdose and underdose are the most likely hazardous situations in insulin pump use, resulting in hypoglycemia or hyperglycemia, respectively.

    “Overdose and underdose are the most likely hazardous situations in insulin pump use resulting in hypoglycemia or hyperglycemia, respectively.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    The GIIP model intentionally excludes many features being pioneered by specific pump manufacturers, such as embedded glucose meters, built-in infusion sets, and remote controllers.

    “We identify features common to these devices as part of our generic insulin pump model and intentionally exclude many features being pioneered by specific pump manufacturers, such as embedded glucose meters, built-in infusion sets, and remote controllers.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User travels to a different time zone and forgets to accommodate so-caused time discrepancy while using the pump is a source of hazardous situations for a generic insulin infusion pump.

    “8.7 User travels to a different time zone and forgets to accommodate so-caused time discrepancy while using the pump”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    The pump controller component represents an abstraction of generic insulin pump software.

    “The pump controller component represents an abstraction of generic insulin pump software.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Leakage of insulin from the delivery path, if left undetected, could cause an underdose hazardous situation.

    “Such an event, if left undetected, could cause an underdose hazardous situation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingreasoning

    Leakage of insulin from the delivery path could cause an incorrect calculation of the amount of insulin to be delivered, which in turn could cause an incorrect calculation of future boluses resulting in an under/overdose hazardous situation.

    “The event could also cause an incorrect calculation of the amount of insulin to be delivered, which in turn will cause an incorrect calculation of future boluses resulting in an under/overdose hazardous situation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Findingnone given

    Incorrect meal bolus is recommended by the bolus calculator is a hazardous situation for a generic insulin infusion pump.

    “3.1.1Incorrect meal bolus is recommended by the bolus calculator”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User fails to test his BG levels as frequently as recommended is a source of hazardous situations for a generic insulin infusion pump.

    “8.6 User fails to test his BG levels as frequently as recommended”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Voltage level of the battery is too low is a source of hazardous situations for a generic insulin infusion pump.

    “6.5.3 Voltage level of the battery is too low”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Dosage of bolus is delivered unevenly over its specified duration is a hazardous situation for a generic insulin infusion pump.

    “2.7 Dosage of bolus is delivered unevenly over its specified duration”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Findingnone given

    Unexpected delivery of insulin is a hazardous situation for a generic insulin infusion pump.

    “2.14 Unexpected delivery of insulin”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Findingnone given

    Pump stops delivering insulin without the user's awareness is a hazardous situation for a generic insulin infusion pump.

    “2.15 Pump stops delivering insulin without the user's awareness”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Incorrect correction bolus is recommended by the bolus calculator is a hazardous situation for a generic insulin infusion pump.

    “3.1.2Incorrect correction bolus is recommended by the bolus calculator”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). The quote only partly states this claim.

    Findingnone given

    Actual flow rate does not match the programmed infusion rate is a hazardous situation for a generic insulin infusion pump.

    “2.11 Actual flow rate does not match the programmed infusion rate”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Inadequate or overcomplicated operating instructions is a hazardous situation for a generic insulin infusion pump.

    “3.14 Inadequate or overcomplicated operating instructions”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Battery life is unpredictable is a source of hazardous situations for a generic insulin infusion pump.

    “6.5.5 Battery life is unpredictable”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User fails to confirm revisions on insulin delivery programs, leaving the pump unchanged without his/her awareness is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.3User fails to confirm revisions on insulin delivery programs, leaving the pump unchanged without his/her awareness”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Findingnone given

    User estimates carbohydrate content of planned meals incorrectly is a source of hazardous situations for a generic insulin infusion pump.

    “8.9.6 User estimates carbohydrate content of planned meals incorrectly”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Outside air pressure is out of safe range or fluctuating inadvertently, causing the pump to deliver insulin inaccurately or to behave erratically is a source of hazardous situations for a generic insulin infusion pump.

    “9.2 Outside air pressure is out of safe range or fluctuating inadvertently, causing the pump to deliver insulin inaccurately or to behave erratically”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User inappropriately cancels a bolus in mid-delivery is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.9User inappropriately cancels a bolus in middelivery”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User commands a bolus to cover a meal but does not eat is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.6 User commands a bolus to cover a meal but does not eat”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User forgets to resume after suspending the pump is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.10User forgets to resume after suspending the pump”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Unauthorized personnel tamper with information critical to insulin delivery is a source of hazardous situations for a generic insulin infusion pump.

    “9.7 Unauthorized personnel tamper with information critical to insulin delivery”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    Unauthorized personnel tamper with pump configuration settings is a source of hazardous situations for a generic insulin infusion pump.

    “9.6 Unauthorized personnel tamper with pump configuration settings”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Outside temperature is out of safe range or fluctuating inadvertently, causing the pump to deliver insulin inaccurately or to behave erratically is a source of hazardous situations for a generic insulin infusion pump.

    “9.1 Outside temperature is out of safe range or fluctuating inadvertently, causing the pump to deliver insulin inaccurately or to behave erratically”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Excessive background noise (preventing the user from attending to pump notifications) is a source of hazardous situations for a generic insulin infusion pump.

    “9.4 Excessive background noise (preventing the user from attending to pump notifications)”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    User forgets to confirm his/her action of starting or stopping a temporary basal, a normal bolus, or an extended bolus is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.5 User forgets to confirm his/her action of starting or stopping a temporary basal, a normal bolus, or an extended bolus”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Outside lighting condition prevents the user from interacting with the pump correctly is a source of hazardous situations for a generic insulin infusion pump.

    “9.5 Outside lighting condition prevents the user from interacting with the pump correctly”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    User commands boluses without consulting with the bolus calculator or inappropriately overrides boluses recommended by the bolus calculator is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.8User commands boluses without consulting with the bolus calculator or inappropriately overrides boluses recommended by the bolus calculator”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User interacts improperly with the input mechanisms of the pump, e.g., pressing the keypad for too long or not long enough, causing the pump to misinterpret the user's intention is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.2User interacts improperly with the input mechanisms of the pump, e.g., pressing the keypad for too long or not long enough, causing the pump to misinterpret the user's intention”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User forgets to confirm his/her action of activating another basal profile, leaving the current basal profile to continue without his/her awareness is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.4User forgets to confirm his/her action of activating another basal profile, leaving the current basal profile to continue without his/her awareness”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    User programs a special basal profile targeted at certain occasions, but forgets to activate this profile when targeted occasions occur is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.11User programs a special basal profile targeted at certain occasions, but forgets to activate this profile when targeted occasions occur”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    User eats but forgets to bolus is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.7 User eats but forgets to bolus”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    User fails to attend to pump notifications is a source of hazardous situations for a generic insulin infusion pump.

    “8.10.12User fails to attend to pump notifications”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationnone given

    The bolus recommendation feature saves users the trouble of calculating bolus doses manually, potentially reducing calculation errors.

    “Such a feature saves users the trouble of calculating bolus doses manually, potentially reducing calculation errors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    Exposure to X-rays, radio frequency identification readers, magnetic resonance imaging, or combinations of radiations is possible for an insulin pump.

    “Similarly, exposure to X-rays (airport security), radio frequency identification readers, magnetic resonance imaging (medical imaging), or combinations of radiations is possible.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    This information can be used in determining an appropriate insulin bolus.

    “This information can be used in determining an appropriate insulin bolus.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The authors incorporated a food database subcomponent in the GIIP model because inaccuracy or incorrectness there can affect correct bolus recommendations and patient safety.

    “We felt it reasonable to incorporate a food database subcomponent in our GIIP model because inaccuracy or incorrectness here can affect correct bolus recommendations, and thus patient safety.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    As more implementation details are established, additional causes of hazardous situations are manifested.

    “As more implementation details are established, additional causes of hazardous situations are manifested.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning

    The hazard analysis results presented are not considered to be exhaustive.

    “The hazard analysis results presented are not considered to be exhaustive.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductcitation

    The preliminary hazard analysis is based on four sources: domain knowledge from manufacturers, pump users, and clinicians; FDA adverse event reports; Diabetes Technology Society workshops; and ISO 14971.

    “The preliminary hazard analysis provided in the Appendix is based on four sources of information: 1. Domain knowledge from manufacturers, pump users, and clinicians 2. Adverse event reports collected by the FDA 3. Workshops sponsored by the Diabetes Technology Society 9,10 4. International Organization for Standardization (ISO) 14971 2”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [2]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    The mobility property might encourage the user to use an insulin pump in environments that have subtle safety implications.

    “The mobility property might encourage the user to use an insulin pump in environments that have subtle safety implications.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    Pump controller bolus recommendations present special risk considerations.

    “Pump controller bolus recommendations present special risk considerations.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    User trust in an incorrectly computed bolus recommendation can cause a hazardous situation.

    “Conversely, user trust in an incorrectly computed bolus recommendation can cause a hazardous situation.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The comprehensiveness of the hazard analysis depends, in part, on the level of design abstraction.

    “The comprehensiveness of the hazard analysis depends, in part, on the level of design abstraction.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    In the home use environment, the pump might be exposed to electromagnetic emissions from cell phones, microwave ovens, or other medical devices that could upset device operation.

    “In the home use environment, the pump might be exposed to electromagnetic emissions from cell phones, microwave ovens, or even other medical devices that could upset device operation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given

    If miniaturization is used as a means of improving mobility, the pump might become more susceptible to electromagnetic disturbances or other types of radiations or introduce new circuit design issues.

    “If miniaturization is used as a means of improving mobility, the pump might become more susceptible to electromagnetic disturbances or other types of radiations or introduce new circuit design issues.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    The food database feature was included in the GIIP model because it may become a common feature and its use (or lack of use) presents risks that should be considered in a hazard analysis.

    “This feature was included in our model because it may become a common feature and its use (or lack of use) presents risks that should be considered in a hazard analysis.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The FDA Manufacturer and User Facility Device Experience database indicated that there were over 5000 adverse events reported for insulin pumps in the year 2008.

    “The Manufacturer and User Facility Device Experience database 3 maintained by the U.S. Food and Drug Administration (FDA) indicates that there were over 5000 adverse events reported for insulin pumps in the year 2008.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [3]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    Pumps with a food database feature can assist the user in estimating the amount of carbohydrates contained in a meal.

    “Pumps with this feature can assist the user in estimating the amount of carbohydrates contained in a meal.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Dual boluses that many insulin pumps support can be modeled as a normal bolus followed by an extended bolus.

    “Dual boluses that many insulin pumps support can be modeled as a normal bolus followed by an extended bolus.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Interpretationreasoning

    The GIIP model's safety-related issues can be mapped to any type of insulin delivery device.

    “However, because the model is a design abstraction, its safetyrelated issues can be mapped to any type of insulin delivery device.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

    Interpretationreasoning

    Mobility factors can often affect the design of multiple device components in subtle ways.

    “Mobility factors can often affect the design of multiple device components in subtle ways.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Study design and conductreasoning

    The hazard analysis is focused on software-driven functionality.

    “We focus our analysis on software-driven functionality.”
    Quote in the paperSubstantial claim
92 of 92

  • The authors state this as an assumption.

    Only four types of insulin administrations can be programmed into or requested from the GIIP.

    “To make our PHA less ambiguous, we assume that only the following four types of insulin administrations can be programmed into or requested from the GIIP:”

  • The paper relies on this without support.

    Not all insulin pumps provide a food database feature.

    “For example, not all insulin pumps provide a food database feature.”

  • The paper relies on this without support.

    The use of food databases by modern insulin pumps is increasing.

    “Another safety issue related to bolus recommendation is the increasing use of food databases by modern insulin pumps.”
3 of 3

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Delayed detection and notification of occlusion without the user's awareness was highlighted as an operational source of hazardous situations, together with underdose due to presence of air replacing insulin in the reservoir or delivery path.

    “Delayed detection and notification of “occlusion without the user's awareness” was highlighted as an operational source of hazardous situations, together with underdose due to presence of air replacing insulin in the reservoir or delivery path—either of which can lead to hospitalization.”

    From Performance of a Continuous Subcutaneous Insulin Infusion (CSII) Pump With Acoustic Volume and Flow Sensing in Simulated High-Consequence Situations (2024) · cites this paper as [8]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Many of these AEs are classifiable as hazards by the 2010 FDA Office of Science and Engineering Laboratories (OSEL) hazard analysis framework.

    “Many of these AEs are classifiable as hazards by the 2010 FDA Office of Science and Engineering Laboratories (OSEL) hazard analysis framework [8].”

    From Performance of a Continuous Subcutaneous Insulin Infusion (CSII) Pump With Acoustic Volume and Flow Sensing in Simulated High-Consequence Situations (2024) · cites this paper as [8]

    The Preliminary Hazard Analysis (page unavailable) says the FDA/OSEL authors used FDA adverse-event reports to develop a generic insulin-pump hazard analysis and categorized hazardous situations. It does not establish that many of the particular AEs in the citing sentence are classifiable as hazards; it also distinguishes hazards from hazardous situations and causal events. (LLM, conf=0.81)

    Experimental — accuracy not yet measured

  • The principal hazards are insulin overdose leading to hypoglycemia, and insulin underdose leading to DKA.

    “The principal hazards are insulin overdose leading to hypoglycemia, and insulin underdose leading to DKA.”

    From Performance of a Continuous Subcutaneous Insulin Infusion (CSII) Pump With Acoustic Volume and Flow Sensing in Simulated High-Consequence Situations (2024) · cites this paper as [8]

    The Preliminary Hazard Analysis identifies overdose and underdose as the most likely hazardous situations in insulin pump use. It links overdose to hypoglycemia, but links underdose to hyperglycemia, not specifically to DKA; searches for “DKA” and “ketoacidosis” found no passage making that link. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Bolus described as correcting both low and high BG

    Minor

    The controller's functions say boluses correct low BG levels, whereas the description of a normal bolus says it corrects high BG levels.

1 of 1

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Related

Authors
Zhang, Y., Jones, P. L., & Jetley, R.
Affiliations
United States Food and Drug Administration (US)
Corresponding author
Zhang, Yi
ORCID
Venue
Journal of Diabetes Science and Technology
Publisher
SAGE Publications
Published
2010-03
Volume
4
Issue
2
Pages
263-283
ISSN
1932-2968 (ISSN-L)
DOI
10.1177/193229681000400207
PMC
PMC2864162
OpenAlex
W2081608336
Semantic Scholar
a278cce9d3214cff8114d0c752dc2ce5ea24dea3
Cited by
61
References
6
Citations by year
2026: 1 · 2025: 1 · 2024: 7 · 2023: 2 · 2022: 2 · 2021: 4 · 2020: 3 · 2019: 8 · 2018: 4 · 2017: 6 · 2016: 5 · 2015: 3 · 2014: 4 · 2013: 5 · 2012: 3
FWCI
11.21
Type
journal article
Language
en
Open access
Licence
journals.sagepub.com/page/policies/text-and-data-mining-license (tdm)
Locations
  • Journal of Diabetes Science and Technology (publishedVersion)
  • PubMed Central (publishedVersion)
  • PubMed (publishedVersion)
Topics
  • Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
  • Health Sciences › Health Professions › Emergency Medical Services › Patient Safety and Medication Errors
  • Social Sciences › Decision Sciences › Statistics, Probability and Uncertainty › Risk and Safety Analysis
Keywords
insulin pump, hazard analysis, medical device safety, model-based engineering, medical device software, diabetes technology, adverse event reports
MeSH terms
Electricity, Equipment Design, Equipment Failure, Humans, Insulin Infusion Systems, Research, Safety, Software, Transportation, Proportional Hazards Models, Disease Transmission, Infectious

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-11-05.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-11-05.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review