Control to Range for Diabetes: Functionality and Modular Architecture

Abstract

Background

Closed-loop control of type 1 diabetes is receiving increasing attention due to advancement in glucose sensor and insulin pump technology. Here the function and structure of a class of control algorithms designed to exert control to range, defined as insulin treatment optimizing glycemia within a predefined target range by preventing extreme glucose fluctuations, are studied.

Methods

The main contribution of the article is definition of a modular architecture for control to range. Emphasis is on system specifications rather than algorithmic realization. The key system architecture elements are two interacting modules: range correction module, which assesses the risk for incipient hyper- or hypoglycemia and adjusts insulin rate accordingly, and safety supervision module, which assesses the risk for hypoglycemia and attenuates or discontinues insulin delivery when necessary. The novel engineering concept of range correction module is that algorithm action is relative to a nominal open-loop strategy—a predefined combination of basal rate and boluses believed to be optimal under nominal conditions.

Results

A proof of concept of the feasibility of our control-to-range strategy is illustrated by using a prototypal implementation tested in silico on patient use cases. These functional and architectural distinctions provide several advantages, including (i) significant insulin delivery corrections are only made if relevant risks are detected; (ii) drawbacks of integral action are avoided, e.g., undershoots with consequent hypoglycemic risks; (iii) a simple linear model is sufficient and complex algorithmic constraints are replaced by safety supervision; and (iv) the nominal profile provides straightforward individualization for each patient.

Conclusions

We believe that the modular control-to-range system is the best approach to incremental development, regulatory approval, industrial deployment, and clinical acceptance of closed-loop control for diabetes.

Introduction

People with type 1 or type 2 diabetes face a life long optimization problem: to maintain strict glycemic control without increasing their risk for hypoglycemia.^1–3 The engineering challenge related to this problem is to design algorithms using automated insulin delivery to exert optimal closed-loop control of glucose fluctuations. Since the early studies of continuous external glucose regulation (e.g., BioStator⁴), two primary approaches have emerged: the use of classic proportional-integral-derivative (PID) algorithms and modern methods based on predictive models of glucose metabolism. The first studies using subcutaneous insulin delivery and continuous glucose monitoring (CGM) employed PID control.^5,6 Model predictive control (MPC) has been receiving considerable attention^7–10 due to its many clinical and engineering advantages. Following the logic of MPC, we argue that progress toward automated closed-loop control will be accelerated greatly by a structured modular approach to building artificial pancreas (AP) components. Specifically, we envision a system of control modules responsible for basal rate, premeal and correction insulin boluses, and hypoglycemia prevention. These modules will be informed by biosystem observers providing information about the patients' glycemic state. A modular approach to closed-loop control development would have a number of advantages that include, but are not limited to:

• Incremental testing of modules in parallel or consecutive studies

• Incremental regulatory approval, industrial deployment, and clinical acceptance of system features

• User flexibility—each system observer or control module could be used separately or within an integrated control system, depending on patients' or physicians' choice

The first step toward a modular artificial pancreas system is the development of control to range, defined as insulin treatment for diabetes, which

• Optimizes glucose control to within a certain target glucose range through the avoidance of extreme glucose fluctuations, specifically via prevention of hypoglycemia and reduction of postprandial hyperglycemia

• Is based on CGM and continuous subcutaneous insulin delivery via an infusion pump

Consequently, we propose an algorithm aiming to achieve control to range that is composed of two interacting modules:

• Range correction module (RCM)

• Safety supervisor module (SSM)

The emphasis is more on “what the algorithm does” rather than on “how the algorithm does it.” The main purpose is to define a modular architecture for control to range and give specifications for the design of its modules. Ideally, the proposed architecture will provide a framework within which several different algorithms may be integrated, provided that they comply with the “what to do” specifications: SSM and RCM may be implemented in different ways as long as the specifications are fulfilled.

To provide a proof of concept of the modular architecture, we then introduce a particular implementation of these modules within a hierarchical architecture of an AP system and illustrate their action via computer simulation of typical use cases run on our in silico system, which has been previously introduced and accepted by the Food and Drug Administration (FDA) as a platform for preclinical experiments with closed-loop control algorithms.^11,12

Fundamental Principles of Control to Range

The basic principles of operation of the RCM and SSM are as follows:

• Both modules receive blood glucose (BG) and insulin data in real time

• The RCM assesses continuously the risk for incipient hyper- or hypoglycemic deviations from the predefined range and adjusts insulin delivery rate as appropriate

• The SSM assesses continuously the risk for hypo-glycemia and attenuates the insulin delivery rate when necessary [e.g., exerts braking action or employs insulin-on-board (IOB) constraints]

• Both the RCM and the SSM permit and account for external insulin manipulation, e.g., basal rate, boluses, or pump shutoff initiated by the patient

• The SSM has override authority over the actions of the RCM and over any external patient-initiated insulin delivery

Therefore, the control actions can be summarized as follows:

• If the risk for hyper- or hypoglycemic deviations from the defined range is detected, based on CGM and delivered insulin, the RCM corrects insulin dosing accordingly

• If the risk for hypoglycemia is detected based on a BG that is too low and/or excess IOB, the SSM reduces or discontinues insulin delivery (braking action or cessation)

• Both modules suggest significant corrections to insulin delivery only if the relevant risks are detected.

The most likely control-to-range scenario would include action of both the RCM and the SSM. It is expected that over time the combined action of the RCM and the SSM will gradually improve the control of type 1 diabetes to within the desired range. This improvement could also be based on “learning” algorithms, such as run-to-run control (anticipated in future implementations of control to range).

Modular Design of Control to Range

The modular architecture of the proposed control-to-range algorithm is shown in Figure 1 and involves decomposition of control, estimation, and signal managementfunctions into multiple timescales. Algorithmic processes will run at three distinct timescales: (1) “continuous time,” defined by the fastest possible rate at which information can be provided by the system's physical layer (e.g., AP hardware interface platform, such as the APS described later¹³); (2) “real time,” defined by the rate at which BG management control updates are computed (e.g., 15-minutesamples); and (3) “off line,” referring to the fact that some data processing (patient individualization) will take place prior to but not during the patient's time under closed-loop control. Each timescale defines a “layer” of the overall architecture within which the control, estimation, and signal management functions will run (Figure 1).

Figure 1.

Modular architecture of control to range. The real-time layer corresponds to the RCM, and the continuous time layer corresponds to the SSM.

The control function of the continuous time layer is the SSM responsible for the prevention of hypoglycemia and comprising algorithms that decide whether to reduce or discontinue the insulin infusion recommendations from the real-time layer, based on continuous time data.

The control function of the real-time layer is the RCM informed by a nominal open-loop strategy (basal and premeal boluses), in which a discrete-time, likely individualized, model of glucose–insulin kinetics is used to compute an optimized correction of nominal open-loop therapy.

The off-line layer of modular architecture serves to assess all available patient data to compute a patient-specific model of the glucose–insulin kinetics, a nominal open-loop strategy (basal and premeal boluses), and control aggressiveness parameter value.

The SSM and the RCM are detailed later. It is important to note that, while in the proposed design these two modules work in cooperation, they can also be deployed individually or sequentially in commercial medical devices. We anticipate that modular design will be the key to future sequential regulatory approval, deployment, and clinical acceptance of automated control-to-range treatment of diabetes.

Safety Supervision Module

Safety supervision is a natural component of any (open- or closed-loop) external glucose control. In control-to-range applications the SSM prevents hypoglycemia by modifying insulin delivery when a risk for hypoglycemia is detected. More generally, the SSM can act as a supervisor in any sensor-pump system.

The SSM is based on a combination of constraints using our established risk analysis of blood glucose data¹⁴ and knowledge of active insulin, e.g., using IOB constraints¹⁵ and “power brakes,¹⁶” making the best possible use of glucose and insulin data. Specifically, the signal management function of the continuous time layer is a data coordinator that serves to relay CGM and pump information to the estimation and control functions within the continuous time layer and also up to the real-time layer (Figure 1). The estimation function of the continuous time layer will receive frequent information about metabolic measurements (continuous glucose) and treatment (insulin injections) and will make internal calculations that assess the risk of hypoglycemia directly and/or indirectly. If the risk of hypoglycemia is high, the SSM intervenes by gradually reducing or discontinuing insulin delivery. Simulation experiments with a doubling insulin delivery rate show that power brakes alone prevent over 95% of otherwise imminent hypoglycemic episodes.¹⁶

Range Correction Module

The key concept of the RCM is the notion of a nominal open-loop profile. The nominal open-loop profile is a treatment strategy determined for each person off-line from patient records or observation, which is believed to be routine or typical for this individual. As described later, the RCM acts by introducing corrections to the nominal treatment strategy. This is a fundamental difference from typical control to target because no specific target glucose is pursued and control actions are limited to corrections of a predetermined nominal profile.

In terms of implementation within our modular architecture (Figure 1), each time step of the discrete time model embedded in the RCM will correspond to 15 minutes of real time. The estimation function of the real time layer is performed by a state update module, which maintains an internal representation of the patient's state based on a patient model identified off-line. The signal management function of the real-time layer is performed by a filtering module, which accepts 1- or 5-minute samples from the continuous time layer and produces appropriate 15-minute inputs to the state update module (Figure 1).

With this understanding, and in order to better characterize the control-to-range action of the RCM, we contrast RCM to control to target.

Control to target calls for integral action (e.g., such as found in PID control⁵) and will take action (insulin correction) continuously as long as the glucose is not exactly equal to the target value. Moreover, constraints on injected insulin and glucose concentration should be explicitly taken into account in the optimization problem. Finally, in order to reach control to target, an unbiased CGM system is needed. In contrast, a control-to-range objective is easier to reach and thus a simpler algorithm is required. In particular,

• The RCM only computes corrections with respect to the nominal open-loop strategy: in fact, the actual pump command is the algebraic sum of a fixed open-loop nominal strategy (basal and premeal boluses), known to the RCM, and closed-loop control corrections decided by the RCM.

• No integral action is included.

• A simple linear model is used.

• Constraints are not considered explicitly but are replaced by the SSM, which may override the control actions suggested by the RCM whenever the risk for hypoglycemia is encountered.

• The aggressiveness of control actions is individualized so as to optimize a control-to-range performance index, such as the control variability grid analysis,^17,18 which allows optimization with respect to a well-defined glucose range by jointly minimizing the risks for hypo- and hyperglycemia.

• Reference glucose range varies according to the nominal open-loop profile, with different limits for night time, postprandial periods, etc. This approach reduces the likelihood of control action when glucose readings are within range.

Physical Layer [Artificial Pancreas Software (APS)]

The APS provides a flexible tool to conduct clinical trials in a clinical research center setting without the need to deal directly with the communication protocols of sensors, pumps, and controllers, as well as unified data log and human machine interface. The software shall call the controller every control cycle and the APS database can be queried by both SSM and RTC layers. The APS has been accepted by the FDA for use in closed-loop investigational systems.¹³

A Proof of Concept: Use Cases

In this section, a proof of concept of the feasibility of our control-to-range specifications is given by a specific SSM and RCM implementation. According to the modular paradigm, this is just one possible realization of the proposed architecture. Alternative algorithms for one or both the modules could be used, provided that they meet the aforementioned specifications.

The SSM is based on the computation of the low BG risk function proposed elsewhere¹⁴ given by

$$\text{Risk}\left(\text{BG}\right)=22.765{\left(\max \left(0,-\left(\log {\left(\text{BG}\right)}^{1.084}-5.381\right)\right)\right)}^2$$

In our SSM, the insulin suggested by the RCM is multiplied by 1/(1 + risk(BG)).

The RCM is based on the unconstrained linear model predictive control algorithm described elsewhere,¹⁹ where more details are available. Its main feature is that, knowing a well-tuned open-loop therapy (given by the ensemble of basal insulin and premeal boluses), the quadratic cost function penalizes the glycemia error with respect to the nominal glycemia associated with the open-loop therapy. In this way, RCM does not rely on a constant set point but on a time-varying profile. For instance, the unavoidable postmeal rise of glycemia is accounted for so that excessive insulin delivery is avoided as long as the glucose rise resembles the nominal one. Although this particular implementation of RCM and SSM cannot be shown to defend a priori boundaries, it is a practical strategy to maintain and possibly recover the desired glucose range in the face of uncertainties and disturbances.

Note that in this implementation, the state update module is rather simple because the input–output nature of the considered MPC algorithm does not require a real observer but just a register of past input and output values.

The proposed control-to-range strategy is illustrated by means of four in silico experiments conducted on a virtual patient.^11,12 All experiments start at 10:00, with the patient at a basal glucose value (140 mg/dl). An open-loop therapy consisting of basal insulin delivery and premeal boluses, proportional to meal amounts, was optimized via trial-and-error experiments on the virtual patient. The four experiments are described here.

1. Open loop in nominal conditions (Figure 2). This experiment shows that in nominal conditions (e.g., nominal meals and nominal insulin sensitivity), a control-to-range objective may be achieved by means of a well-calibrated open-loop therapy. However, as highlighted by subsequent experiments, an entirely different picture arises when nominal conditions are perturbed.

2. Control to range vs open loop with perturbed meals (Figure 3). Closed-loop control starts at 13:00. Actual meals differ from nominal ones so that the open-loop therapy is no longer optimal: the first two meals are greater than the nominal ones while the third is smaller and delayed by 30 minutes. In response to meal confirmation, RCM administers an appropriate insulin bolus based on nominal meal size according to the nominal open-loop profile (Figure 3; see the plot at 18:00). However, if an incipient hyperglycemic deviation is identified, as happens at 18:30, RCM increases the insulin delivery rate above the nominal open-loop basal level. Conversely, after identifying an incipient hypoglycemic deviation, as happens at 7:30, RCM attenuates the insulin delivery rate below the nominal basal level for open-loop control. On two occasions, at 1:00 and 8:00, hypoglycemia risk is detected and the SSM enforces attenuation of insulin delivery. Overall, control to range is more robust than open-loop therapy because it applies corrections in order to cope reactively with unexpected deviations from nominal profiles of glycemia, meals, and insulin.

3. Control to range vs open loop with nominal meals and perturbed insulin sensitivity (Figure 4). In this experiment, insulin sensitivity is 25% higher than the assumed nominal insulin sensitivity and, as a result, open-loop therapy fails to prevent hypoglycemia. Both RCM and SSM act to maintain glycemia within the range. On three occasions, at 14:00, 20:00, and 9:45, hypoglycemia risks are detected and the SSM enforces attenuation of insulin delivery. Again, control to range is more robust than open-loop therapy.

4. Control to range vs open loop with perturbed meals and perturbed insulin sensitivity (Figure 5). In this experiment the perturbations described in the two previous experiments occur simultaneously. Open-loop control cannot avoid a severe hypoglycemic episode after the third meal. However, joint action of the RCM and SSM achieves a more effective glycemic regulation. In particular, on three occasions the SSM prevents possible hypoglycemia. In this difficult experiment under conditions that are far from nominal, control to range proves more robust than open-loop therapy in preventing hypoglycemia.

Figure 2.

Open-loop glycemic regulation in nominal conditions. Open-loop therapy consisting of basal insulin and premeal boluses proportional to meal amounts was optimized via trial-and-error experiments on the virtual patient. Regulation is satisfactory as it maintains glycemia within the range.

Figure 3.

Control-to-range vs open-loop glycemic regulation under perturbed meals. Closed-loop control starts at 13:00. Actual meals (blue dots) differ from nominal ones so that the open-loop therapy is no more optimal. Then, the RCM applies corrections in order to achieve a faster recovery of glycemic regulation within the range. The first two meals are greater than nominal, leading to administration of additional insulin. Because the control to range relies on nominal open-loop therapy, after the first two meals the initial rise of glycemia is similar to that observed in open loop. However, the RCM reacts and gives supplementary insulin so that recovery of within-range glycemia is faster than in open loop. This faster recovery is less evident after the first meal because closed-loop regulation is initiated at 13:00, when the glycemic peak has already been reached. The second meal is entirely under closed-loop regulation, and recovery within the range is therefore faster. The third meal is smaller than the nominal one and is delayed by 30 minutes. To cope with this perturbation, the RCM decreases the insulin basal value temporarily. On two occasions, a risk for hypoglycemia is detected and the SSM enforces attenuation of insulin delivery (red line, bottom).

Figure 4.

Control-to-range vs open-loop glycemic regulation under nominal meals and perturbed insulin sensitivity. Closed-loop control starts at 13:00. Insulin sensitivity is 25% higher than nominal; consequently the open loop fails to prevent hypoglycemia. RCM and SSM act to maintain glycemic regulation within the range. On three occasions, risks for hypoglycemia are detected and the SSM further enforces attenuation of insulin delivery (red line, bottom). Between 20:00 and 22:30 insulin delivery is decreased compared to the nominal open-loop basal one. This explains the glucose peak around midnight and, as a consequence, the higher glucose profile during all night leading to the 125-mg/dl fasting glucose, even if nocturnal closed-loop insulin delivery does not differ from the open-loop basal.

Figure 5.

Control-to-range vs open-loop glycemic regulation under perturbed meals and perturbed insulin sensitivity. Closed-loop control starts at 13:00. Insulin sensitivity is 25% higher than nominal. The first two meals are greater than nominal, which counterbalances the reduction in insulin sensitivity and helps open-loop control maintain glycemia within the range. Nevertheless, it cannot avoid a severe hypoglycemia after the third meal, which is smaller than nominal and delayed by 30 minutes. The joint action of the RCM and SSM achieves effective glycemic regulation. In particular, when risk for hypoglycemia is detected on three occasions, the SSM prevents possible hypoglycemia.

Conclusions

Compared to traditional control-to-target algorithms, a control-to-range algorithm, made of the combination of SSM and RCM, is easily implementable on current commercial devices because there is no need for real-time parameter estimation or iteration procedures. Individualization is accomplished easily via the nominal profile of each person and can be based on a few clinical parameters (as experimented successfully in silico¹⁹ and in vivo^20,21) or on an informative screening visit. Model individualization via ARX modeling^22,23 can be used as well. These properties greatly simplify implementation of the control actions and accelerate the path toward regulatory approval and clinical application.

We have to note that the output of a dynamic system with delays cannot be guaranteed to be maintained within a precise target range by applying control actions only when the output goes outside the range. Thus, in order to guarantee that glycemia is maintained within target range, the RCM and the SSM will need to begin making corrections to insulin delivery while the BG is still within target range. This means that elevated risks for hypo- or hyperglycemia will be anticipated while the BG is still within target range—a notion that is inherent with our risk analysis theory.¹⁴

Abbreviations

AP

artificial pancreas

APS

artificial pancreas software

BG

blood glucose

CGM

continuous glucose monitoring

MPC

model predictive control

FDA

Food and Drug Administration

IOB

insulin on board

PID

proportional-integral-derivative

RCM

range correction module

SSM

safety supervisor module