Design of the Health Monitoring System for the Artificial Pancreas: Low Glucose Prediction Module

Abstract

Background

The purpose of this study was to design and evaluate a safety system for the artificial pancreas device system (APDS). Safe operation of the APDS is a critical task, where the safety system is engaged only as needed to ensure reliable operation without positive feedback to the controller.

Methods

The Health Monitoring System (HMS) was designed as a modular system to ensure the safety of the APDS and the user. It was designed using a large set of ambulatory data and evaluated in silico by inducing hypoglycemia with a missed meal [bolus for a 65 g carbohydrate (CHO) meal] and administering rescue CHOs per HMS alerting. The HMS was validated in-clinic with a real-life challenge of a subject who overdosed insulin prior to admission.

Results

The HMS was evaluated for clinical use with a 15 min prediction horizon. Retrospectively, 93.5% of episodes were detected with 2.9 false alarms per day. During in silico evaluation, the HMS reduced the time spent <70 mg/dl from 15% to 3%. When the HMS was first tested in-clinic, the subject overdosed ~3 U of insulin prior to her arrival to a closed-loop session (against protocol). The controller reduced insulin delivery, and the HMS gave four alerts that were successfully received via clinical software and text and multimedia messages. Even with insulin reduction and CHO supplements, hypoglycemia was unavoidable but manageable due to the HMS, confirming that a safety system to detect adverse events is an essential part of the APDS.

Conclusions

The ability of the HMS to be an effective alert system that provides a safety layer to the APDS controller has been demonstrated in a clinical setting.

Introduction

Control of type 1 diabetes mellitus has historically been a practice of the subject who self-monitors glucose and self-administers insulin several times per day, with the guidance of their physician.¹ Advances in glucose sensing and insulin-administering technology have made automatic control feasible.^2,3 The artificial pancreas device system (APDS) comprises a continuous glucose monitor (CGM), a computer-controlled algorithm, an insulin pump, and the patient effect.⁴ The APDS is engineered to control blood glucose using automatic insulin delivery, calculated by the internal “brain” of the system, the control algorithm. Because the APDS will control blood glucose, which is the primary source of energy in the body, and do so by manipulating insulin, a toxic drug if given at high doses, it is classified as a high-risk device.^5,6 The APDS design requires that multiple safety layers be built around the control algorithm to ensure the health of the user and the proper condition of the device.

The APDS has been designed in several forms and tested in a clinical setting.^7–11 Safety components such asincorporation of insulin on board (IOB),¹⁰ bolus interceptor,¹² insulin feedback,¹³ and the safety supervision module (SSM)¹⁴ have been designed for use in the APDS. These safety systems have generally been designed in series or integrated with the control algorithm.^15,16 Such systems function as governors on the controller and, in the case of SSM, as an alert algorithm using traffic lights.¹⁴ These systems have proven to be effective in silico and in clinical use by constantly being active and, as such, reducing insulin delivery. This approach provides a safety layer to the APDS; however, this may be interpreted as a high-level controller or governor rather than a pure safety or monitoring system. By acting in series with the controller, this type of safety system may be in conflict with the internal controller prediction and may create unnecessary aggressive control moves to compensate for altered insulin delivery by the governor, hindering potential clinical effectiveness. One of the inherent limitations of the APDS, compared with other high-risk systems such as nuclear reactors, is that there is a lack of redundant sensors due to “body real estate” and cost, so only one sensor on the controlled variable is generally used. One way to overcome this limitation is to approach the system with multilayer data analysis that utilizes the glucose measurement in mathematically different ways in each module, as is shown in this article.

The Health Monitoring System (HMS) has been designed as a process monitoring and alert module that can be executed in real time in parallel to any controller for the APDS or in pump-augmented therapy (see Figure 1). The HMS comprises several safety modules, including predicting and alerting for hypoglycemia, hyperglycemia, and missed meals; pump and sensor error detection; and communication monitoring. The use of CGMs allows adverse glycemic excursions to be predicted.^17–19 The low glucose predictor (LGP) was designed to predict hypo-glycemia episodes and transmit this information to the alarm module of the HMS.^20–22

Figure 1.

Artificial pancreas device system structure with parallel controller and safety system. Lines of communication are dashed, with optional lines in gray

Methods

A “layer of protection” design approach is used in this system, where the controller is tasked with glucose regulation to a predefined zone and several safety layers protect the system.^23,24 If the controller cannot prevent extreme events, the second layer is engaged to guarantee the overall safety of the system. This system monitors the device at all times and engages the user if and only if it predicts an extreme condition that cannot be mitigated solely by closed-loop controller action and that requires outside intervention, with no interaction with the control loop. The control algorithm manipulates the delivery of insulin, while the HMS evaluates the trend of the glucose in a mathematically different way from the controller, in order to provide an extra layer of safety to ensure the health of the subject. The HMS provides three different alerts: (a) local audio and visual prompts; (b) short message service (SMS); and (c) multimedia message service (MMS). The HMS has the ability to ensure safety through implementation of escalating alarms: a local alarm initially, then increasing the scope with a global alarm (SMS/MMS) to an emergency contact, followed by a health care provider or call center if no response is detected, as illustrated by Dassau and coauthors.²⁵ The first module of the HMS to be evaluated is the hypoglycemia component, or LGP, which uses a set of constraints to predict the imminent occurrence of hypoglycemia (see Figure 2 for flow chart). The LGP has three primary modules: a preprocessing module to prepare CGM data for prediction, a missed point handling module to estimate the value of missed points (in parallel with the preprocessing module), and a core algorithm section to calculate rate of change, make predictions, and determine if hypoglycemia is imminent. These data are sent to the alarm mode module (see Figure 3 for flowchart) of the HMS to issue audible and visual alerts and send warning SMS and MMS notifications. The SMS and MMS notifications are sent to the physician in charge or other primary contact with a profile of the current trend and prediction for the next 15 min.²⁵

Figure 2.

Low glucose predictor algorithm flow chart

Figure 3.

Health Monitoring System alarm mode flowchart

The method of action recommended by the HMS is ingestion of rescue carbohydrates (CHOs). Several other approaches to hypoglycemia mitigation are possible, including pump suspension¹⁷ or administration of a low dose of glucagon in a dual hormone approach.⁹ Suspending the pump may help to prevent some hypo-glycemia events caused by a “wrong” basal or physical activity but cannot prevent a hypoglycemia event caused by a missed meal or insulin overdose. The HMS was designed as an alert system for such situations as well as events that cannot be prevented by merely attenuating or suspending the insulin pump. In the context of the APDS, where the control algorithm is typically based on a model predictive control (MPC) design, insulin delivery attenuation or pump suspension will be an appropriate response of the control algorithm as soon as it predicts that hypoglycemia is imminent. The use of glucagon has been shown by El-Khatib and coauthors⁹ as a second controller, used continuously in small amounts (less than a therapeutic rescue dose). The use of glucagon in that manner may not be feasible due to its instability in solution²⁶ and potential for depletion of glycogen stores when used for a long period.²⁷

Low Glucose Predictor Design

The preprocessing component of the LGP is used to filter the CGM data for prediction. This is motivated by the presence of noisy data, missed data points, or shifts due to calibration. These issues are addressed in the preprocessing section, described here.

Sustainability and operability of a safety system is a key design principle. The ability to operate without the need for user input is a clear advantage of the HMS over other safety systems and control algorithms. As such, notification of calibration, physical activity, meals, or any other external prompt is not needed. The inherent calibration detection feature provides a smooth transition even when calibration is conducted. Calibration detection without announcement is achieved via the first component of the preprocessing section. In order to make a better and more accurate prediction, shifts introduced to the system, such as calibrations, must be detected so that the shift does not produce a nonphysiologic rate of change estimate. A shift in the signal is detected when the change in the raw signal is too large (absolute value > 4 mg/dl/min, considered to be nonphysiologic²⁸) and then the next data point continues roughly the same trend as before the shift, but with an offset. When a shift is detected, the points after the shift can be considered more accurate, and the same offset can be applied to the points before the shift to reflect the true trend.

Filtering the noisy CGM data is conducted using physiologically based parameters to ensure that data reflect the glucose value accurately. The algorithm filters the data using a noise-spike filter²⁹ to reduce the impact of noise spikes,

$$G_{F,NS}\left(k\right)=\left\{\begin{array}{c}{G}_m\left(k\right)if\left|G_m\left(k\right)-G_F\left(k-1\right)\right|\le \Delta G\\ G_F\left(k-1\right)-\Delta Gif\left(G_F\left(k-1\right)-G_m\left(k\right)\right)>\Delta G\\ G_F\left(k-1\right)+\Delta Gif\left(G_m\left(k\right)-G_F\left(k-1\right)\right)>\Delta G\end{array}\right.$$ (1)

where k is the sampling instant, G_F(k – 1) is the previous filtered value, G_F,NS(k) is the filtered value resulting from the noise-spike filter, G_m(k – 1) is the measurement, and ΔG is the maximum allowable change from one instant to the next.²⁹ The data are then passed through a low-pass filter to dampen high frequency fluctuations from noise, as follows:

$$G_F(k)=\frac{\Delta t}{{\tau }_F+\Delta t}{G}_{F,NS}(k)+(1-\frac{\Delta t}{{\tau }_F+\Delta t})G_F(k-1)$$ (2)

where G_F(k) is the filtered value, Δt is the sampling period, and τF is the filter time constant.²⁹ The filter is the second component of the preprocessing section. The pre-processing section implicitly adds a small delay to the system, typically less than 5 min. Future implementations of APDS will have the HMS imbedded in the core of the CGM glucose engine, alleviating the issue of the HMS filter contributing to additional delay.

The last component of the preprocessing section is interpolation, in which recent data gaps are filled so that the most recent data can be used for prediction. When a data point is missing, its value is extrapolated to allow a prediction to be made at that point in time. The algorithm then extrapolates gaps of up to 20 min in a linear manner:

$$\widehat{G_F}(k)=G{\prime }_F(k-m)(t(k)-t(k-m))+G_F(k-m)$$ (3)

where Ĝ_F is the extrapolated value, m is the number of missed points, G_’F(k– m) is the estimated rate of change m steps before, and GF(k– m) is the filtered glucose value m steps behind. This feature ensures operability of the safety system even when the CGM signal is lost at the critical time when glucose is trending toward the hypoglycemia zone. Estimating glucose values during periods of lost signal may result in a false positive alarm, but ensuring the safety of the system by catching impending hypoglycemia outweighs the possibility of incurring a false positive alarm. This feature illustrates one of the design principles of the HMS: operability even during data outages to guarantee safe operation of the APDS. It should be noted that, with gaps longer than 20 min, the algorithm waits for new data to make predictions, because after several minutes, the confidence that the predicted trend used to fill gaps is accurate decreases significantly. However, upcoming CGM techno-logy has made gaps of that duration a rare occurrence.

The next element in the LGP is the core algorithm, in which the rate of change is calculated to make a prediction and issue an alarm if hypoglycemia is imminent. The rate of change is calculated and extra-polated linearly through the hypoglycemia threshold to decide if hypoglycemia will occur within the prediction horizon (PH). The rate of change calculation is performed using the first derivative of the Lagrange interpolation polynomial as follows:

$$\begin{array}{l}G{\prime }_F(j)\cong \frac{t(j)-t(j-1)}{(t(j-2)-t(j-1))(t(j-2)-t(j))}{G}_F(j-2)+\\ \frac{t(j)-t(j-2)}{(t(j-1)-t(j-2))(t(j-1)-t(j))}{G}_F(j-1)+\\ \frac{2t(j)-t(j-2)-t(j-1)}{(t(j)-t(j-1))(t(j)-t(j-2)}{G}_F(j)\end{array}$$ (4)

whereG’_F(j) is the estimated rate of change at point j, t is time, G_F is the filtered glucose value, j = k – SAR + 1: k, and SAR is the number of successive alarms required for an alert to be engaged.³⁰ The rate of change can be analyzed via a Kalman filter or other methods,³⁰ but the simpler approach in Equation (4) has yielded better or comparable results with less computation.³¹

Alarm Mode Module

The alarm mode will be activated if hypoglycemia is predicted or if the current measurement is below the hypoglycemia threshold (e.g., 70 mg/dl) and the rate of change is negative [G’_F(k) < –0.1 mg/dl/min]. However, if the current measurement is above a threshold, for example, 110 mg/dl, the alarm mode is not activated, because it is not close to the hypoglycemia threshold. In addition, no alarm is generated if the rate of change is more negative than -3 mg/dl/min, which is considered to be nonphysiologic and most likely related to local compression effects. This requirement is an extra safety feature to reduce unnecessary alarms that could result in user noncompliance. See Figure 3 for a flowchart of the alarm mode.

If at least 30 min have elapsed since the last alarm, the alarm mode will issue an audible and visual alarm on the APDS human–machine interface and send a SMS notification to the user or attending physician. The SMS sends a text-only notification, while the MMS sends an attached chart showing the trending of recent glucose values and the predicted values for the next 15 min (see Figure 4). Although some phones cannot receive a chart, the SMS notification can be received by most cell phones. The SMS and MMS notifications are redundant to the active alarm in the APDS to ensure that treatment is given. The visual and audible alarm that appears on the APDS clearly indicates that the individual with type 1 diabetes should consume approximately 16 g of CHOs. The user may select the “ignore” button of the HMS warning. In that case, at the next cycle, i.e., 5 min later, if the glucose concentration is predicted to be <70 mg/dl or is already <70 mg/dl, then a new set of alarms will sound and appear.

Figure 4.

Multimedia message sent to physician from HMS during clinical trial

The user may select the “accept” button and treat with CHOs as recommended. The system will continue to perform a new analysis of the glucose prediction based on the new data point in the background, but it will not activate any warning for the following 30 min, thus the alert system will be blocked. This allows the effect of ingesting CHOs to take place. After 30 min, if the calculation continues to predict that the glucose is <70 mg/dl in the next 15 min or is already <70 mg/dl, then a new visual and audible alarm will be raised and new SMS and MMS notifications will be sent. There is a risk that the user may select “accept” and not treat, followed by a lockout in which no alarms could occur. In the current system, the physician is responsible for dispensing rescue CHOs, ensuring safety. In a future APDS, multiple layers would be incorporated, including a low hypoglycemia threshold alarm to ensure safety in the event that the predictive LGP alarm is acknowledged falsely. In addition, the lockout window can be decreased to allow more frequent alarms if no recovery is detected.

Retrospective Evaluation

The HMS with LGP was evaluated using retrospective glucose data. The retrospective study utilized ambulatory data from seven subjects with type 1 diabetes mellitus (negative C-peptide concentration) collected by the Sansum Diabetes Research Institute, Santa Barbara, CA. The record consisted of 393 days of CGM data (Dexcom™ SEVEN™ PLUS, San Diego, CA) with a 5 min sampling period. See Table 1 for additional details. These data represent a real-life record in which hypoglycemia occurs under ambulatory conditions. The data were processed with three PH values (15, 30, and 60 minutes).

Table 1.

Characteristics of Retrospective Clinical Data

Number of subjects	7
Sensor type	Dexcom SEVEN PLUS
Sample frequency	5 min
Overall duration	393 days
Median duration per subject	67 days
Samples below 70 mg/dl	13.5%
Samples above 180 mg/dl	10.4%
Hypoglycemia episodes	766
Samples positioned in false positive region	72.4%

In Silico Study

An in silico study to mimic hypoglycemia caused by a skipped meal/overcorrection was conducted using the Food and Drug Administration (FDA)-accepted University of Virginia/Padova metabolic simulator set of 10 published subjects.³² All scenarios were 18 h, with closed-loop operation starting at 2 h. Meals/boluses were given at 2.5 h, with boluses and basal rates set to default subject-specific simulator values. Simulated CGM values with a sampling period of 5 min were used for HMS. The following protocols were used: (A) control: basal only, no meal; (B) control with meal: basal, 65 g meal with optimal bolus; (C) skipped meal: basal, optimal bolus for 65 g meal without meal delivery; and (D) skipped meal with rescue: basal, optimal bolus for 65 g meal without delivery, HMS active starting at 2 h with a 15 min PH and a SAR of 1. The rescue dose was the standard 16 g CHO, currently recommended by the American Diabetes Association (ADA)³³ and used in the clinical trials detailed here.

Clinical Trial Evaluation

The HMS was evaluated clinically in parallel to zone MPC^23,34 via the artificial pancreas system (APS©). Zone MPC is used to maintain blood glucose in a predefined range, increasing or decreasing insulin delivery accordingly, when the CGM measurement or predictions by the internal model violate the boundaries of the zone. This type of controller is an extension of MPC, first published in the context of diabetes control by Parker and coauthors,^35,36 which controlled to a set point rather than a zone. The Dexcom SEVEN PLUS CGM was used for subcutaneous glucose sensing, and insulin delivery was effected using the Animas® OneTouch® Ping® (West Chester, PA). The protocol included automatic closed-loop control from approximately 5:00 PM followed by an unannounced 50 g CHO dinner meal, overnight control, an unannounced 40 g CHO breakfast meal, an unannounced 16 g CHO snack (pre-exercise) if the reference glucose was <120 mg/dl, 30 min mild exercise, and a 16 g CHO snack 3 h post-exercise.

Results

Retrospective Evaluation

Results were generated for all subjects using the HMS, both with and without the preprocessing module (latter denoted HMS_basic). Overall, results are shown in Figure 5 and 6. In Figure 5, the true positive ratio (TPR), or percentage of hypoglycemic events that were predicted by the algorithm within 1 h prior to the event, is plotted versus the false positive ratio (FPR), the ratio of false positive alarms to the number of readings in the false positive region. Hypoglycemia events were defined, in this study, when the unfiltered CGM data were under the hypo-glycemia threshold (e.g., 70 mg/dl) for at least 10 min.³⁷ The false positive region is defined as the sum of all segments not in hypoglycemia (<70 mg/dl) or the hour preceding the onset of hypoglycemia.³⁷ Only predictive alarms were assessed, not including any alarms that occurred during hypoglycemia. Results with both the HMS and the HMS_basic show an increase in both TPR and FPR as the PH increases, as would be expected.The most significant result of this study is the shifting of the points from HMS_basic to HMS upward and to the left. This result suggests that the modifications of the data used in the preprocessing section cause more hypoglycemia events to be detected with fewer false alarms.

Figure 5.

TPRs and FPRs for the retrospective study. The HMS with and without preprocessing are denoted by HMS (open shapes) and HMS_basic (filled shapes), respectively. Prediction horizons shown are 15 min (blue circles), 30 min (green squares), and 60 min (red triangles)

Figure 6.

Warning time, t_W, for retrospective study. The HMS with and without preprocessing are denoted by HMS (solid curves) and HMS_basic (dashed curves), respectively. Prediction horizons shown are 15 min (blue curves), 30 min (green curves), and 60 min (red curves)

Figure 6 shows the distribution of warning time, t_W, for both HMS and HMS_basic, using PH values of 15, 30, and 60 min. The t_W is the time from the first alarm in the true positive region to the onset of hypoglycemia, indicating the amount of time available to act on an alarm. Because a large data set was assessed, the distribution of warning times indicates the probability that an alarm will occur within a certain time period prior to the event. For instance, using HMS and a PH setting of 15 min, the probability that the first alarm will be more than 15 min ahead is 45%. The probability of the first alarm occurring more than 30 min ahead decreases to 22%. With this PH setting, alarms will occur within a fairly short time before the event, with 93% of events detected and less than three false alarms per day, as seen in Figure 5. This setting is ideal for the purposes of alarming for immediate treatment, because it is the most accurate and has the least potential for causing alarm fatigue, a common phenomenon caused by an excessive number of false alarms.³⁸

In Silico Study

Using the FDA-accepted University of Virginia/Padova 10-subject metabolic simulator, hypoglycemia was induced in several scenarios (see Figure 7 and Table 2), one using HMS (Figure 7D) to predict and mitigate hypoglycemia using rescue CHOs. The spectrum of CGM values for all subjects is displayed using a heat plot for the duration of the simulation, with values <70 mg/dl in dark blue and >180 mg/dl in dark red. Meals and hypoglycemia treatments are shown in black and white bars, respectively. Figure 7A shows the control with basal only scenario and no obvious hypoglycemia or hyperglycemia, while Figure 7B shows the control with 65 g CHO meals and optimal bolus and a moderate amount of postprandial hyperglycemia (5% of time spent >180 mg/dl). The HMS was tested without mitigating the hypoglycemia event in Figure 7C, where the optimal bolus for a 65 g CHO meal was given without meal administration, with subsequent hypoglycemia evident in dark blue (15% of time spent <70 mg/dl). True and false positive alarms are shown as white and black crosses, respectively. The ability of the HMS to mitigate these hypoglycemia episodes is shown in Figure 7D, where the alarms were acted upon by delivery of rescue CHOs; the dramatic reduction in hypoglycemia is evident by the decrease in dark blue cells (3% of time spent <70 mg/dl). Using the HMS with this large missed meal allowed for an 80% reduction in time spent in hypoglycemia, along with a 40% reduction in the number of episodes.

Figure 7.

Results of an in silico study of 10 adult subjects. (A) the control scenario with basal/bolus only. (B) The control scenario with a 65 g CHO meal. (C) The scenario with a bolus for a 65 g CHO meal without meal delivery. (D) The scenario of C with hypoglycemia treatment triggered by HMS. False positive alarms (black crosses) and true positive alarms (white crosses) are shown for protocols without corrective action (A–C). Meals are shown in black bars and rescue CHOs are shown in white bars. The color scale is skewed to red >180 mg/dl and blue <70 mg/dl to highlight hyperglycemia and hypoglycemia

Table 2.

Summary of In Silico Results for 10 Subjects Using the Health Monitoring System to Recommend Rescue Carbohydrates

	Number of episodes	Time spent <70 mg/dl (%)	Time spent >180 mg/dl (%)	Minimum CGM value (mg/dl)	Average minimum CGM value (mg/dl)
A. Control	0	0	1	93	118
B. Control with meal	0	0	5	83	99
C. Skipped meal	10	15	0	32	52
D. Skipped meal with rescue	6	3	0	37	65

Clinical Trial Case Study

The HMS has been evaluated in parallel to zone MPC^23,34 in 13 closed-loop studies. One admission is described in detail here, showing the ability of the HMS to alert and mitigate severe hypoglycemia (see Figure 8). The following events are included to provide the necessary details for the hypoglycemia event. Of the 12 enrolled subjects, the first enrolled subject did not complete the first studyday as explained hereafter and had to return. A blinded CGM was placed on the subject 2 days prior to the scheduled closed-loop day. Before arriving at the clinical research center (CRC) for the start of the closed-loop session, she took 3.35 U of insulin to correct for her hyperglycemia (correction factor of 1 to 70) for an elevated capillary glucose value of 270 mg/dl at 2:09 pm, approximately 2 h before her visit to the CRC. With this correction factor, her blood glucose would be predicted to drop by approximately 235 mg/dl, or to around 35 mg/dl. Upon being connected to the APDS during initialization, the HMS predictive alarm was triggered because of the rate of decrease of her glucose caused by the recent outpatient correction bolus. All procedures for glucose rescue were followed. The HMS was triggered an additional three times over the next 2 h. The YSI nadir was 44 mg/dl, with mild symptoms of hypoglycemia. The admission was stopped at that time, and additional oral glucose was given. The subject was discharged once her glucose concentration was stabilized at a safe level and was rescheduled for a different study day.

Figure 8.

Overview of the clinical case study using the HMS in which the trial was ended early due to low blood glucose. Continuous glucose monitor, YSI, and finger stick values are plotted on top as blue triangles, black squares, and red dots, respectively, with HMS alarms plotted on top of CGM values. Meals and HMS treatments are shown in purple and green, respectively.

Discussion

The HMS was designed using a large set of ambulatory data in order to make it robust to real-world disturbances and sensor fluctuations. The various design parameters used in the HMS allow the system to be tuned according to the type of hypoglycemia mitigation to be used, from alerting for rescue to suspending the insulin pump for prevention. This flexibility will allow the HMS to ensure safety through the use of escalating alarms by alerting locally first, followed by increasingly global alerts as the situation becomes more urgent.

The results of a retrospective study were used to select the tuning of the HMS for the clinic. Before clinical trials began, the HMS was tested in silico to show that it could effectively reduce or eliminate hypoglycemia when tuned for alerting for rescue CHO consumption. Even with a very large missed meal (65 g CHO), time in hypoglycemia (<70 mg/dl) was reduced by 80% (Table 2).

This design of the HMS was applied in the clinical setting along with a control algorithm (zone MPC). The results of the initial clinical case study confirmed the ability of the HMS to alert by both prediction and recognition of current hypoglycemia (Figure 4 and Figure 8). The HMS was validated, with SMS and MMS notifications being delivered promptly along with pop-up messages on the APS. The parallel nature of the zone MPC/HMS system allowed for the controller to reduce insulin infusion while HMS predicted hypoglycemia based on CGM trajectories. Unfortunately, even though the controller gave much less insulin than standard care (~25% of standard care), hypoglycemia was unavoidable, even with ingestion of rescue CHOs. To address the ADA guidelines on hypoglycemia treatments, the HMS has been updated to change the alert timeout to every 15 min when CGM value is <70 mg/dl.³³ Allowing for more frequent alarms when the CGM value is low will provide extra safety for subjects who have overdosed.

Conclusions

The HMS was designed as a parallel safety system that can be used for the APDS or pump-augmented therapy to alert for and mitigate adverse events. This design was meant to ensure the safety of the subject and to add robustness to the overall system. The HMS has a modular design to accommodate several safety layers for detecting a variety of adverse events, such as hypoglycemia, missedmeals, and pump occlusions. Technology is used to announce adverse events automatically to a predefined list of responders via a pop-up on the APDS and/or CGM and SMS/MMS push notification via telemedicine.

The HMS has been evaluated using retrospective clinical data and prospectively implemented in silico and in vivo with clinical settings of a 15 min PH and a SAR of 1. Retrospectively, 93.5% of episodes were detected within 1 h, while 55% of episodes detected were within 15 min of the event (Figures 5 and 6). This is important because the goal of this algorithm is a high-level rescue alert and, therefore, should focus on immediately imminent events. Only 2.9 false alarms per day were reported, a sufficiently low number to prevent alarm fatigue in an ambulatory setting and overtreatment in a clinical setting.

During in silico evaluation, a skipped meal of 65 g was simulated. Without rescue CHOs, the average minimum CGM value was 52 mg/dl, with 15% of time spent <70 mg/dl. With the HMS, there was a five-fold reduction in the time spent in hypoglycemia and a nearly two-fold reduction in the number of episodes (Figure 7 and Table 2).

In the first clinical case study of zone MPC with the HMS, the HMS was challenged with a common human error of insulin stacking (Figure 8). The system was validated, with four alerts given and successfully received via APS and SMS/MMS (Figure 4). Regardless of the reduction of insulin delivery by the controller, hypoglycemia was unavoidable, confirming that a safety system to detect adverse events is an essential part of the APDS. The HMS has been shown in-clinic to be an effective, modular safety system to operate in parallel to the APDS control algorithm.

Glossary

(ADA)

American Diabetes Association

(APDS)

artificial pancreas device system

(APS)

artificial pancreas system

(CGM)

continuous glucose monitor

(CHO)

carbohydrate

(CRC)

clinical research center

(FDA)

Food and Drug Administration

(FPR)

false positive ratio

(HMS)

Health Monitoring System

(IOB)

insulin on board

(LGP)

low glucose predictor

(MMS)

multimedia message service

(MPC)

model predictive control

(PH)

prediction horizon

(SAR)

successive alarms required

(SMS)

short message service

(SSM)

safety supervision module

(TPR)

true positive ratio

Funding

This study was supported by the National Institutes of Health Grants DK085628-01 and DP3DK094331-01). Rebecca A. Harvey received financial support from the Eugene Cota-Robles Fellowship and the Air Products and Chemicals Discovery Fellowship. Product support was received from Dexcom Inc. This research was conducted with product support from the Investigator-Initiated Study Program of LifeScan Corporation.