Periodic zone-MPC with asymmetric costs for outpatient-ready safety of an artificial pancreas to treat type 1 diabetes^*

Abstract

A novel Model Predictive Control (MPC) law for an Artificial Pancreas (AP) to automatically deliver insulin to people with type 1 diabetes is proposed. The MPC law is an enhancement of the authors’ zone-MPC approach that has successfully been trialled in-clinic, and targets the safe outpatient deployment of an AP. The MPC law controls blood-glucose levels to a diurnally time-dependent zone, and enforces diurnal, hard input constraints. The main algorithmic novelty is the use of asymmetric input costs in the MPC problem’s objective function. This improves safety by facilitating the independent design of the controller’s responses to hyperglycemia and hypoglycemia. The proposed controller performs predictive pump-suspension in the face of impending hypoglycemia, and subsequent predictive pump-resumption, based only on clinical needs and feedback. The proposed MPC strategy’s benefits are demonstrated by in-silico studies as well as highlights from a US Food and Drug Administration approved clinical trial in which 32 subjects each completed two 25 hour closed-loop sessions employing the proposed MPC law.

1 Introduction

Type 1 Diabetes Mellitus (T1DM) is an auto-immune disease that destroys the pancreas’ β-cells, rendering people with T1DM incapable of producing insulin, a hormone that facilitates absorption of glucose from the blood-stream into various types of cell, and that plays a crucial role in the endocrine feedback mechanisms that lead to glucose homeostasis in healthy people. People with T1DM tend to suffer chronic hyperglycemia and a lack of glucose homeostasis, causing severe and incurable health problems in later life, e.g., premature cardiovascular diseases, nephropathy, retinopathy, and neuropathy [1,2]. The number of people with T1DM in the United States is estimated to be about 1.46 million, nearly 0.5% of the population [1]. Treating T1DM using an external source of insulin is effective, albeit burdensome, but determining the required dosage is difficult, or impossible, even for experienced and diligent patients. Insulin over-delivery causes hypoglycemia, which may quickly lead to seizures, coma, and death. This work is motivated by the enormous potential for automatic feedback control of insulin delivery to improve the clinical outcomes, and alleviate the burden, resulting from the treatment of T1DM.

Research into a so-called Artificial Pancreas (AP), a device that performs automatic insulin dosing and delivery to people with T1DM, started in the 1970s [3,4], but through the development of the Continuous Glucose Monitor (CGM) [5] only became feasible beyond intensive care units much later [6–10]. AP control laws based on Model Predictive Control (MPC) [11–15], proportional-integral-derivative control [16,17], or MD/fuzzy logic [18,19] have been deployed in human trials. Other control schemes have been proposed and tested in-silico, e.g., ℋ_∞ [20,21] and linear parameter-varying [22] control. The authors’ group has been focusing increasingly on developing zone-MPC strategies [23–26], whereby the controller reduces insulin delivery from, or supplements insulin in addition to, subjects’ basal-insulin only when blood-glucose levels are predicted to make an excursion from a target zone, rather than deviate from a singular setpoint. This was motivated by clinical intuition; there is not one optimal glucose level, instead all glucose levels considered safe form an interval. Furthermore, zone-MPC has proven effective in real-life operation of an AP, yielding control laws that exhibit limited intervention. Use of a zone induces robustness to plant-model mismatch, model bias, and CGM sensor errors; the controller does not respond to small deviations from the setpoint, instead intervenes only when there is a strong indication that intervention is required.

Only recently has an AP been considered feasible in out-patient settings [27–30], facilitated by improvements in CGM accuracy and the availability of consumer-oriented Continuous Subcutaneous Insulin Infusion (CSII) pumps. Safety concerns for outpatient AP deployment are different than for in-clinic use, and it is a contribution of the MPC strategy proposed in this paper to explicitly address these. A primary concern is that while asleep patients cannot monitor themselves or their equipment, and may not respond to alarms. Thus it is the responsibility of the control system to safeguard patients from hypoglycemia, the main immediate risk when treating with insulin, without requiring user-interaction. The proposed strategy improves safety by employing a glucose target zone that is diurnal, i.e., periodic based on the time of day (see Sec. 2.3). At night, assumed (and enforced in trials) to be the time of sleep, the target zone is raised, encouraging elevated glucose levels and thereby reduced hypoglycemia risk. Additionally, the proposed strategy enforces a diurnal input constraint that limits nighttime insulin infusion to 1.8 times the subjects’ basal-rate, limiting the controller’s leeway to correct hyperglycemia (see Sec. 2.4). Diurnal zones and input constraints were first described in [25].

Protection from hypoglycemia is more critical at home than in-clinic where, e.g., rescue by intra-venous glucose infusion is feasible. Thus, even when patients are awake and aware of their current state, the control system must prevent hypoglycemia suitably before glucose concentrations descend to levels at which patients experience symptoms. What is required are predictive insulin delivery suspensions. The proposed MPC strategy (see Sec. 2.6) performs appropriate predictive pump-suspensions, and subsequent predictive pump-resumptions, promoted by the use of novel asymmetric input cost functions in the MPC formulation, first described in [26] (see Sec. 4).

Elements of the proposed MPC strategy were proposed previously, but are brought together in this work, and with settings tuned over multiple previous clinical trials. The MPC algorithm proposed in this paper was trialled in the first clinical deployment of the authors’ zone-MPC approach in an outpatient setting; for details consult the clinical companion paper [31]. It is a contribution of this paper to describe the proposed MPC strategy in reproducible detail, and to demonstrate its efficacy and features using data obtained from real-life testing during US Food and Drug Administration (FDA) approved trials [31]. The paper is organized as follows: The feedback MPC strategy is described in Sec. 2. A feed-forward method to announcing meal intake to the control system is presented in Sec. 3. The novel asymmetric input cost functions are discussed in Sec. 4. In Sec. 5 an outline of the simulation test procedures and results to obtain FDA approval are provided. Highlights of clinical trials using the presented approach are discussed in Sec. 6.

2 Control Law Design

2.1 Insulin-glucose dynamics: Control-relevant model

Control law design is based on the discrete-time, linear time-invariant (LTI) model of insulin-glucose dynamics proposed in [24], with sample-period T := 5 [min]. The time step index is denoted by i. The scalar plant input is the administered insulin bolus u_IN,i [U] delivered per sample-period, and the scalar plant output is the subject’s blood-glucose value y_BG,i [mg/dL]. The model is linearized around the steady-state of the subject-specific, time-dependent basal input rate u_BASAL,i [U/h], achieving a blood-glucose output y_s := 110 [mg/dL]. The LTI model’s input u_i and output y_i are defined as:

$$u_i:=u_{\text{IN},i}-\frac{u_{\text{BASAL},i}T}{60min/\mathrm{h}},y_i:=y_{\text{BG},i}-y_{\mathrm{s}}.$$

We denote by 𝒴 (𝓏⁻¹) and 𝒰 (𝓏⁻¹) the z-transform of the signals of input u_i and output y_i, respectively. The transfer characteristics from u to y are described by

$$\frac{\mathcal{Y}({\mathcal{z}}^{-1})}{\mathcal{U}({\mathcal{z}}^{-1})}=\frac{1800Fc}{u_{\text{TDI}}}·\frac{{\mathcal{z}}^{-3}}{(1-p_1{\mathcal{z}}^{-1}){(1-p_2{\mathcal{z}}^{-1})}^2}$$ (1)

with poles p₁ := 0.98, p₂ := 0.965, the subject specific total daily insulin amount u_TDI ∈ ℝ_>0 [U], and where c := −60 (1 − p₁) (1 − p₂)² is used to set the correct gain, and for unit conversion. The so-called safety factor F is unitless and provides a mechanism to personalize the model gain to the subject; however, F := 1.5 is fixed throughout this paper. The 1800 term stems from the “1800 rule” to estimate blood-glucose decrease with respect to (w.r.t.) the delivery of rapid-acting insulin [32]. The state-space realization of (1) used in this work is

$$\begin{array}{ll}\hfill x_{i+1}& ={Ax}_i+{Bu}_i,y_i={Cx}_i\hfill \\ \hfill A:& =\left[\begin{array}{ccc}{p}_1+2p_2& -2p_1{p}_2-p_2^2& p_1{p}_2^2\\ 1& 0& 0\\ 0& 1& 0\end{array}\right]\in {ℝ}^{3\times 3}\hfill \\ \hfill B:& =\frac{1800Fc}{u_{\text{TDI}}}{\left[\begin{array}{ccc}1& 0& 0\end{array}\right]}^{\top }\in {ℝ}^3,C:=\left[\begin{array}{ccc}0& 0& 1\end{array}\right]\in {ℝ}^{1\times 3}.\hfill \end{array}$$ (2)

The structures of A and C indicate that, in the absence of noise, at time-step i the three state elements x_[3], x_[2], and x_[1] correspond to y_i, y_i+1, and y_i+2, respectively.

2.2 State-estimation

The proposed MPC strategy is designed for use with a CGM that updates its glucose measurement output ỹ_i at the controller’s update period T = 5 [min]. At each step i let ỹ_i ∈ ℝ denote the most recent CGM measurement. An estimate x_i of the state of model (2) is provided at each step i by linear recursive state-estimator (3) (Luenberger observer, see, e.g., [33]). No notational distinction between the actual and estimated state is made, because state x of (2) can only be estimated. Adjusting penalization term R allows tuning the estimator’s noise rejection capabilities; the stated value was arrived at by experimentation using the University of Virginia/Padova (UVA/Padova) FDA accepted metabolic simulator [34,35].

$$x_i={\widehat{x}}_i+L(({\stackrel{\sim }{y}}_i-y_{\mathrm{s}})-{\widehat{y}}_i)$$ (3a)

$$\begin{array}{l}{\widehat{y}}_i=C{\widehat{x}}_i,{\widehat{x}}_i={Ax}_{i-1}+{Bu}_{i-1}\\ L^{\top }:=-{(R+{\mathit{CPC}}^{\top })}^{-1}{\mathit{CPA}}^{\top }\\ P=Q+{\mathit{APA}}^{\top }-AP{C}^{\top }{(R+{\mathit{CPC}}^{\top })}^{-1}{\mathit{CPA}}^{\top }\\ Q:=I_3,R:=1000\end{array}$$ (3b)

2.3 Diurnal blood-glucose target zone

Zone-MPC penalizes predicted blood-glucose trajectories based on their excursion from a target zone [23,24]. The proposed periodic zone-MPC scheme uses a zone that is dependent on the time of day; the interval [80, 140] mg/dL during the day, [110, 170] mg/dL at night, with two-hour transitions in between. Such diurnal zones help enforce increased safety from nocturnal hypoglycemia and were first employed in [25]. Let τ₁ := 4, τ₂ := 6, τ₃ := 22, and τ₄ := 24 denote specific times of day, and let t ∈ [0, 24] denote the current time of day, all in hours after midnight. The zone-excursion function Z : ℝ × ℝ → ℝ is defined in (4). The zone’s upper and lower bounds ẑ (t) and z̆(t) are defined in (5) and (6), respectively, and are plotted in Fig. 1. The zone’s switching times and boundary values were decided upon after successful and safe testing with different values in [25], and after discussions with endocrinologists and the FDA.

Fig. 1.

Diurnal glucose target zone (top) and diurnal, individualized upper-bound on insulin infusion input (bottom).

$$Z(y,t):=arg{min}_{\alpha \in ℝ}\{{\alpha }^2\mid y+y_{\mathrm{s}}-\alpha \in [\check{z}(t),\widehat{z}(t)]\}$$ (4)

$$\widehat{z}(t):=140+\lambda (t)(170-140)$$ (5)

$$\begin{array}{l}\check{z}(t):=80+\lambda (t)(110-80)\\ \lambda (t):=\{\begin{array}{ll}\frac{1}{2}cos\left(\pi \frac{t-{\tau }_1}{{\tau }_2-{\tau }_1}\right)+\frac{1}{2}\hfill & \text{if}t\in [{\tau }_1,{\tau }_2)\hfill \\ 0\hfill & \text{if}t\in [{\tau }_2,{\tau }_3)\hfill \\ \frac{1}{2}cos\left(\pi \left(1+\frac{t-{\tau }_3}{{\tau }_4-{\tau }_3}\right)\right)+\frac{1}{2}\hfill & \text{if}t\in [{\tau }_2,{\tau }_4)\hfill \\ 1\hfill & \text{otherwise}\hfill \end{array}\end{array}$$ (6)

2.4 Diurnal insulin delivery constraints

At each step i the controller must enforce the constraint

$$\begin{array}{ll}\hfill 0& \le u_i+\frac{u_{\text{BASAL},i}T}{60min/\mathrm{h}}\le {\overline{u}}_i,\\ \hfill {\overline{u}}_i:& =\{\begin{array}{ll}{u}_{\text{MAX}}\hfill & \text{if}{t}_i\in [{\tau }_1,{\tau }_3]\hfill \\ \beta \frac{u_{\text{BASAL},i}T}{60min/\mathrm{h}}\hfill & \text{otherwise}\hfill \end{array},\beta :=1.8\end{array}$$ (7)

where t_i denotes the time of day, in hours after mid-night, associated with time-step i, and u_MAX := 25 [U] denotes a bound on the bolus size the CSII pump is permitted to deliver. The value of u_MAX was chosen so large it is highly unlikely to ever be commanded by the controller (see also Sec. 3). Thus, during the day the insulin infusion is practically unbounded. However, during the night the insulin infusion is constrained to 80% in excess of the subject’s basal-rate. This diurnal input constraint is a further safeguard against nocturnal hypoglycemia and was introduced in [25]. The multiplication factor β = 1.8 was arrived at after successful and safe testing with a lower value in [25], and after discussions with endocrinologists and the FDA. Note that in terms of absolute infusion the nighttime constraint may be time-dependent, because a subject’s basal-rate profile typically switches between multiple (usually 3–8) values (see Figs. 5 & 6). Furthermore, the nighttime constraint is personalized to the subject, because subjects have their own basal-rate profiles. The diurnal input constraint is depicted in Fig. 1. Note that the input constraint switches instantaneously between the daytime and nighttime values, and that the switching instant is at the start of the transition periods of the blood-glucose target zone; this enforces safer insulin delivery going into nighttime and times of sleep, and gives the controller extra leeway to reduce hyperglycemia in the early morning, approaching breakfast time.

Fig. 5.

Closed-loop clinical trial example 1; see Sec. 6.3. Top: CGM (blue dots), [80, 140] mg/dL (green area), [70, 180] mg/dL (yellow area), exercise period (gray area), diurnal target zone (black lines), dinner (Di), breakfast (Br), and lunch (Lu) sizes. Bottom: Closed-loop insulin delivery (red line), open-loop meal-boluses (blue bars), basal rate (dashed green line), diurnal safety constraint (black line).

Fig. 6.

Closed-loop clinical trial example 2; see Sec. 6.4. Key same as Fig. 5.

2.5 Insulin on board (IOB) constraints

Insulin delivery is further subject to an Insulin On Board (IOB) constraint – a constraint based on the insulin delivery history, preventing over-delivery when much insulin was recently delivered, e.g., after a meal-bolus (see Sec. 3). The notion of IOB constraints was obtained from [36] and modified. Let vectors θ_l ∈ ℝ ⁹⁶ for l ∈ {2, 4, 6, 8} denote the 2, 4, 6, 8 hour decay curves depicted in Fig. 2; no mathematical definition is available. The curves are sampled at T = 5 [min] intervals, and each curve is eight hours in duration, padded with trailing zeros when necessary: 8h/T = 96. The decay curve θ_i applicable at step i depends on the most recent CGM measurement ỹ_i:

$${\theta }_i:=\{\begin{array}{ll}{\theta }_2\hfill & \text{if}{\stackrel{\sim }{y}}_i>300\hfill \\ {\theta }_4\hfill & \text{if}{\stackrel{\sim }{y}}_i\in (200,300]\hfill \\ {\theta }_6\hfill & \text{if}{\stackrel{\sim }{y}}_i\in (140,200]\hfill \\ {\theta }_8\hfill & \text{otherwise}.\hfill \end{array}$$ (8)

Fig. 2.

Two, four, six, and eight hour IOB (insulin on board) decay curves from [32] and used in IOB constraints in [36].

Let Λ_BASAL ∈ ℝ ⁹⁶ denote the 8 hour history of linearized insulin infusion, as provided by pump-feedback (with no delivery errors this is analogous to u_i but with pump-discretization [see Sec. 2.7]), but setting to zero the value at any step were a meal-bolus was delivered (see Sec. 3). Further denote by Λ_MEAL ∈ ℝ⁹⁶ the 8 hour history of meal-boluses, by Θ ∈ ℝ the estimated IOB present, by Γ ∈ ℝ the required IOB, which depends on the current blood-glucose level, and by C_F,i ∈ ℝ_>0 [(mg/dL)/U] the patient’s so-called correction-factor at time-step i. At each time step i the IOB upper bound ū_IOB is given by

$$\begin{array}{ll}\hfill {\overline{u}}_{\text{IOB},i}& :=\{\begin{array}{ll}{\mathrm{\Gamma }}_i-{\mathrm{\Theta }}_i\hfill & \text{if}{\mathrm{\Gamma }}_i>{\mathrm{\Theta }}_i\hfill \\ 0\hfill & \text{otherwise}\hfill \end{array}\hfill \\ \hfill {\mathrm{\Gamma }}_i& :=({\stackrel{\sim }{y}}_i-y_{\mathrm{s}})/C_{\mathrm{F},i}\hfill \\ \hfill {\mathrm{\Theta }}_i& :={\theta }_i^{\top }{\mathrm{\Lambda }}_{\text{BASAL},i}+{\theta }_4^{\top }{\mathrm{\Lambda }}_{\text{MEAL},i}.\hfill \end{array}$$ (9)

It holds that ū_IOB,i ≥ 0, and ū_IOB,i = 0 implies the controller delivers no more than the basal rate. Thus, after a large bolus the insulin delivery is temporarily constrained to the basal rate, but note that IOB constraint (9) cannot constrain insulin delivery to below the basal rate. The selection of the current decay curve in (8) is based on physiological intuition; higher blood-glucose levels lead to a more rapid metabolization of insulin, thus a shorter decay curve is selected. From a control perspective, the result of this is that at higher blood-glucose levels the past insulin delivery tightens the current IOB constraint less than at lower blood-glucose levels. Subsequently, the controller is permitted more leeway to actively reduce hyperglycemia, by means of higher insulin infusion commands. Note that meal-boluses contribute to the estimated IOB based on the 4-hour IOB curve θ₄, irrespective of glucose levels.

2.6 MPC problem

For MPC background the reader is referred to [37,38]. We denote by u, x, y, the predicted input u, state x, and glucose output y, respectively, by N_y := 9 the prediction horizon, by N_u := 5 the control horizon, by R̂ := 7000 and R̆ := 100 weighting coefficients for non-negative and non-positive control inputs, respectively. For prediction step k we denote by t_k the time of day of the time-instant of step i + k, in hours after midnight. Let ${\mathbb{Z}}_a^b$ denote the set of consecutive integers {a,..., b}. MPC performs closed-loop control by applying at each step i the first element ${\mathrm{u}}_0^{\ast }$ of the optimal, predicted control input trajectory { ${\mathrm{u}}_0^{\ast },\dots ,{\mathrm{u}}_{N_{\mathrm{u}}-1}^{\ast }$}, characterized as follows.

MPC Problem

Determine

$$\{{\mathrm{u}}_0^{\ast },\dots ,{\mathrm{u}}_{N_{\mathrm{u}}-1}^{\ast }\}:=\underset{\{{\mathrm{u}}_0,\dots ,{\mathrm{u}}_{N_{\mathrm{u}}-1}\}}{argmin}J(x_i,\{{\mathrm{u}}_0,\dots ,{\mathrm{u}}_{N_{\mathrm{u}}-1}\})$$

with cost function

$$J(·,·):={\sum }_{k=1}^{N_{\mathrm{y}}}{\mathrm{z}}_k^2={\sum }_{k=0}^{N_{\mathrm{u}}-1}[\widehat{R}{\widehat{\mathrm{u}}}_k^2+\check{R}{\check{u}}_k^2]$$ (10)

and subject to

$${\mathrm{x}}_0:=x_i$$ (11a)

$${\mathrm{x}}_{k+1}:=A{\mathrm{x}}_k+B{\mathrm{u}}_k\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{y}}-1}$$ (11b)

$${\mathrm{y}}_k:=C{\mathrm{x}}_k\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{y}}}$$ (11c)

$$0\le {\mathrm{u}}_k+\frac{u_{\text{BASAL},i}T}{60min/\mathrm{h}}\le {\overline{u}}_{i+k}\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{u}}-1}$$ (11d)

$${\mathrm{u}}_k\le {\overline{u}}_{\text{IOB},i}\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{u}}-1}$$ (11e)

$${\mathrm{u}}_k:=0\forall k\in {\mathbb{Z}}_{N_{\mathrm{u}}}^{N_{\mathrm{y}}-1}$$ (11f)

$${\mathrm{z}}_k:=Z({\mathrm{y}}_k,{\mathrm{t}}_k)\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{y}}}$$ (11g)

$${\widehat{\mathrm{u}}}_k:=max({\mathrm{u}}_k,0)\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{u}}-1}$$ (11h)

$${\check{\mathrm{u}}}_k:=min({\mathrm{u}}_k,0)\forall k\in {\mathbb{Z}}_0^{N_{\mathrm{u}}-1}.$$ (11i)

Eqs. (11a)–(11c) enforce the prediction dynamics of model (2), initialized to an estimate of the current state (see Sec. 2.2). Eqs. (11d) and (11e) enforce input constraint (7) and (9), respectively, across the control horizon. Eq. (11f) implies that beyond the control horizon exactly the basal-rate is delivered. Eq. (11g) provides the zone deviation of (4) to penalize in (10). Eqs. (11h) and (11i) provide the non-negative and non-positive deviations of the input u from the basal-rate, respectively. The above MPC Problem can be formulated (details omitted) as a strictly convex, continuous quadratic program (QP). The (linearized) control input is $u_i:={\mathrm{u}}_0^{\ast }$.

2.7 Pump-discretization

The proposed control strategy was destined for deployment with a CSII pump that has a delivery resolution of δ := 0.05 [U] when used in an AP. After the solution u_i to the MPC Problem is determined, the final, absolute control input ũ_i [U] commanded to the pump is characterized according to a so-called carry-over scheme

$$\begin{array}{l}{\stackrel{\sim }{u}}_i:=\delta \lfloor \frac{{\widehat{u}}_i}{\delta }\rfloor ,{\widehat{u}}_i:=u_i+u_{\text{CARRY},i}+\frac{u_{\text{BASAL},i}T}{60min/\mathrm{h}}\\ u_{\text{CARRY},i}:={\widehat{u}}_{i-1}-{\stackrel{\sim }{u}}_{i-1}\ge 0,u_{\text{CARRY},0}:=0\end{array}$$

where ⌊ · ⌋ denotes flooring. Suppose u_i is persistently a value between two pump-discretization levels. The resulting trajectory of ũ_i then toggles between the level above and that below the control input u_i. This toggling can be seen in Figs. 3, 5, and 6. Note that upper bounds on the insulin input are enforced on the MPC solution, not when applying the pump-discretization. Suppose the MPC solution satisfies an upper bound that lies between two pump-discretization levels, and that this constraint is active. The carry-over scheme results in the ũ_i trajectory repeatedly, temporarily violating the upper bound, but satisfying it on average over multiple steps. This phenomenon is depicted in Fig. 5 (4–5am).

Fig. 3.

Simulation of adult#1 of full-version UVA/Padova simulator with proposed asymmetric (A), symmetric-high (B), and symmetric-low (C) input weights – see Table 1.

2.8 Controller personalization & de-tuning

Those parameters of the proposed strategy that are subject specific are the total daily insulin amount u_TDI, the basal-rate profile u_BASAL,i, the correction-factor profile C_F,i, and the carbohydrate-ratio profile C_R,i (employed in Sec. 3). Subjects generally know these parameters’ values to a suitable accuracy. Importantly, all other controller parameters, e.g., the prediction horizon N_y, control horizon N_u, input costs R̂ and R̆, glucose target zone boundaries, etc., are the same for all subjects, and were chosen to lead to a control law that performs successfully on average while remaining safe for outlier subjects.

The various design parameters were selected through extensive numerical testing with the UVA/Padova simulator, based on experience from clinical trials, and after consultations with endocrinologists. After determining a well-tuned set of parameters the value of R̂, and the lengths of IOB curves in (8), were intentionally increased to the stated values, to result in a control law that is deliberately slightly de-tuned. The clinical trial results (see Sec. 6 & [31]) indicate this caution was prudent.

3 Meal-Bolusing Strategy

Users of the AP control system have the option of announcing meals to the controller, or to consume meals without announcement. Without announcement the control system responds to the resulting blood-glucose rise based solely on CGM feedback. In the case of announced meals the control system performs feed-forward control-action by delivering a meal-bolus of a size that is a function of the meal size M ∈ ℝ_≥0 [gCHO] (grams of carbohydrates), provided by the subject, and the blood-glucose level, provided by CGM measurements. The meal-bolus is delivered in its entirety at the time the subject enters the meal-size into the control system and acknowledges the computed final bolus size.

At each step i we denote by C_R,i ∈ ℝ_>0 [gCHO/U] the subject’s so-called carbohydrate-ratio, by ỹ_i ∈ ℝ the most recent CGM measurement, and by Δ_i ∈ [0, ∞] [min] the length of time that has elapsed between the measurement of ỹ_i and the current controller call. By slight abuse of notation we let Δ_i = ∞ when no CGM measurement is available. At a step i following a meal-announcement the MPC law of Sec. 2.6 is by-passed and the insulin infusion command is characterized as follows:

$$\begin{array}{ll}\hfill u_i:& =\{\begin{array}{ll}B+min(\overline{B},2)\hfill & \text{if}({\stackrel{\sim }{y}}_i\ge 140)\wedge ({\mathrm{\Delta }}_i\le 20)\hfill \\ 0.8B\hfill & \text{otherwise}\hfill \end{array}\\ \hfill \overline{B}:& =({\stackrel{\sim }{y}}_i-140)/C_{\mathrm{F},i},B:=M/C_{\mathrm{R},i}.\end{array}$$

The basic bolus size B, based on meal-size and carbohydrate-ratio, is adjusted so that a correction B̄ is added when blood-glucose exceeds 140 mg/dL. The correction is limited to 2 [U]. At low blood-glucose levels, or when no recent CGM measurement is available, the basic bolus size B is reduced by 20%. This reduction is a safety feature; if required the controller can increase insulin delivery later to correct high blood-glucose values, but removing excessive insulin is not possible. The switching threshold, bound, and reduction ratio were arrived at through discussions with endocrinologists.

4 Asymmetric Cost Functions

The glucose control problem is highly asymmetric, for three reasons. First, the consequences of hypoglycemia are immediate and more detrimental than those of (temporary) hyperglycemia; a blood-glucose level within the interval [80, 140] mg/dL is generally considered safe, but a drop to 30 mg/dL may be fatal, whereas an equisized excursion to 190 mg/dL is common and of no clinical concern if it is brief. Second, basal insulin rates are generally low, giving a controller only little leeway to attenuate insulin delivery from basal before being constrained by the fact that insulin cannot be removed from the system (i.e., u_IN ≥ 0); in contrast, aggressive insulin infusion above basal is physically realizable. Third, in the single-hormone AP considered here there is no antagonistic control action to insulin, short of “commanding” a subject to consume food. This asymmetry is well known and commented on, yet most glucose controllers do not address it, even though a controller that does was proposed a long time ago [4]. For example, most MPC schemes use symmetric, quadratic cost functions to penalize both predicted glucose outputs and insulin inputs. Weights in (10) that are symmetric (i.e., R̂ = R̆) pose a challenge: A controller tuned to respond conservatively to hyperglycemia (i.e., R̂ is large) has difficulty performing a pump-suspension in the face of hypoglycemia. Conversely, a controller tuned to easily perform pump-attenuations (i.e., R̆ is small) tends to over-correct hyperglycemia, resulting in controller-induced hypoglycemia and oscillations following blood-glucose highs. AP controllers are frequently equipped with safety logic, input modulators, or supervisory control systems, to mitigate the effects of this trade-off. The asymmetric input cost function of (10) decouples the design of the controller’s responses to hyperglycemia and hypoglycemia, and requires no ad-hoc auxiliary safeguards.

To demonstrate we consider the numerical simulation of one subject using the UVA/Padova simulator [34,35]. The closed-loop simulation starts at 8am. At 9am a 2 U bolus is delivered to mimic the spontaneous occurrence of a hypoglycemic event. At 2pm a 90 gCHO meal is ingested that is unannounced, i.e., no feed-forward meal-bolus is delivered (see Sec. 3). We consider the three tunings summarized in Table 1; corresponding blood-glucose and insulin delivery trajectories are depicted in Fig. 3. With the symmetric-high cost, the cost scheme typically employed in MPC of an AP, the pump fails to perform a pump-suspension around 10am despite acute hypoglycemia, but delivers appropriately conservatively w.r.t. the meal, from 2–7pm. Using the symmetric-low cost, the pump appropriately suspends delivery around 10am, but catastrophic over-delivery occurs in response to the meal around 3pm. Use of the asymmetric cost function permits the controller to both appropriately suspend the pump in response to hypoglycemia, and also deliver appropriately conservatively w.r.t. the meal. The three glucose minima around 10am are similar. First, the glucose drop is dominated by the 2 U bolus. Second, the UVA/Padova simulator displays a robustness to, and resilience from, hypoglycemia exceeding that of many people, who may suffer persistent hypoglycemia. The value R̂ = 7000 was chosen to yield a controller that is suitably conservative w.r.t. hyperglycemia. The value R̆ = 100 was chosen so small that it never poses an obstacle to pump-attenuation when predicted blood-glucose values trend beneath the glucose target zone, but large enough that when the predicted blood-glucose trajectory enters the zone from below, the control input is “pulled” firmly to its setpoint, zero, i.e., the basal-rate in absolute infusion terms. There is no physiological significance to the value of R̆, or the ratio R̂/R̆ = 70.

Table 1.

MPC input weights for three different controller settings.

MPC style	R̂	R̆	Figures
Asymmetric (proposed)	7000	100	3 (A), 4 (left)
Symmetric-high	7000	7000	3 (B), 4 (right)
Symmetric-low	100	100	3 (C)

The use of asymmetric cost functions in MPC of an AP was considered in [13,39–47] and mentioned in a few more publications by those works’ authors. The proposals all differ from one another, but in each the asymmetry is applied to the output cost function, not the input cost function as here. This is in some sense irrelevant, because it is the ratio of output cost vs. input cost that determines the controller’s behavior. However, it indicates contrasting motivations. Most of the aforementioned references attempted to address the asymmetry of the glucose control problem in terms of glucose risk, in that hypoglycemia is riskier than hyperglycemia. In contrast, the objective of the proposed asymmetric input costs is to facilitate appropriate pump-attenuations. Importantly, the level of asymmetry in this proposal is much greater than in most of the referenced works. It is not a given that a risk function is a suitable objective function for controller design. Because insulin delivery cannot be reversed or corrected for (bar bi-hormonal control and rescue carbohydrates), predicted hypoglycemia requires very “aggressive” pump-suspension. (Furthermore, risk functions are generally only valid, or defined, over the domain of physiologic glucose values, whereas MPC output cost functions require a wider domain, e.g., including negative glucose values.) Some works confuse asymmetry for nonlinearity, concluding the need for a nonlinear program to accommodate cost functions more general than symmetric. However, using an LTI model, asymmetric, convex linear/quadratic cost functions, whether on outputs or inputs, can be incorporated within a continuous, convex linear/quadratic program. Note that such a program requires auxiliary optimization variables and must be solved subject to hard constraints.

The works [45–47] stand out particularly favorably for two reasons. First, the asymmetry seems to have been designed based on controller considerations, not physiology, as in this proposal; the level of asymmetry there slightly exceeds that here. Second, in most other works the asymmetry was either only considered within a benchmark problem for in-silico tests, and not meant for implementation, or considered beneficial in in-silico tests, but abandoned for clinical trials. In contrast, the asymmetric cost functions of [45–47] appear to have been deployed in trials, as has the strategy proposed here.

5 Numerical Simulations

A synopsis of the simulation testing performed for final validation, and for obtaining FDA approval, of the proposed controller is presented in this section. The presented results were obtained using the most recent version of the UVA/Padova simulator with all 111 available in-silico subjects, combining those of the 10-subject and 100-subject simulators (the latter includes a 101^st subject “average”). FDA approval was based on the 100 in-silico subjects of an earlier version of the UVA/Padova simulator, which had a different physiological model.

Simulations are 28 hours in duration, starting at 2pm. Closed-loop control commences at 4pm. Dinner, breakfast, and lunch are consumed at 6:30pm, 7am, and 1pm, respectively, closely mimicking the clinical protocol (see Sec. 6.2). The clinical protocol prescribes that meals be announced, with meal-boluses delivered at the start of mealingestion. For FDA approval the described scenario was simulated on the entire cohort of the full UVA/Padova simulator using a large number of permutations of parameter values that were either nominal, or incorrect to varying degrees, e.g., basal-rates and meal-estimates being excessive or insufficient. For brevity only two cases are presented here; a) nominal, i.e., all parameters are “optimal” with respect to the in-silico subjects’ characteristics, and meals are announced exactly, and b) parameters are nominal but meals are unannounced, i.e., meal-sizes are severely under-estimated. Unannounced meals are one of the toughest challenges for an AP controller. The clinical protocol allows subjects to choose their own meal-sizes, but imposes a limit of 90 gCHO (a large meal for most people). To stress the controller, simulations were performed with 90 gCHO meals for dinner, breakfast, and lunch. Note that the UVA/Padova simulator by design includes in-silico subjects with parameter values at the boundary of, or slightly beyond, physiologic plausibility.

Table 2 lists the results. The first set of rows contains time-in-range percentages for various Blood-Glucose (BG) ranges and thresholds. The second set of rows lists the number of events of BG beyond the stated thresholds. The third set of rows lists the number of pump suspensions of various lengths. The UCSB Health Monitoring System (HMS) [48], which provides predictive hypoglycemia alarms, was run during the simulations, and the number of HMS alarms is listed. Low Blood Glucose Index (LBGI) and High Blood Glucose Index (HBGI) values were computed according to [13]. Control-Variability Grid Analysis (CVGA) is based on [49]; see Fig. 4 for CVGA plots. As expected, the nominal case with announced meals results in both lower hyperglycemia risk and lower hypoglycemia risk compared to the case of unannounced meals. However, for both announced and unannounced meals the proposed asymmetric MPC strategy results in substantially reduced hypoglycemia risk, and fewer HMS alarms, than the symmetric-high MPC strategy. The penalty for this is a slightly elevated hyperglycemia risk. The number of pump suspensions with the proposed asymmetric MPC strategy is significantly increased, demonstrating “aggressive” efforts to protect from hypoglycemia. Importantly, the symmetric-high MPC law has very few pump suspensions, despite the high number of hypo-glycemic events. For both announced and unannounced meals the proposed asymmetric MPC strategy causes the CVGA clusters to unambiguously shift to the left (glucose lows are higher) while shifting the clusters only very slightly upwards (glucose highs are only slightly higher). Based on all tests it was concluded that the asymmetric input cost function significantly improves the safety from hypoglycemia of the proposed MPC scheme. While in this paper only the detailed comparison of the proposed asymmetric and symmetric-high MPC strategy is provided, based on extensive testing the authors conclude that the proposed asymmetric MPC approach outperforms any symmetric one (of the MPC structure described herein).

Table 2.

Results for the four cases depicted in Fig. 4.

MPC style		Proposed	Sym-high	Proposed	Sym-high
Meals		Announced		Unannounced
BG [mg/dL] % time	∈ [80, 140]	49.82	57.51	40.67	46.82
	∈ [70, 180]	77.00	78.29	59.49	59.95
	< 80	0.38	0.79	1.38	2.34
	< 70	0.17	0.34	0.90	1.23
	< 60	0.06	0.13	0.57	0.75
	< 50	0.01	0.03	0.30	0.41
	< 40	0.00	0.00	0.08	0.13
	> 180	22.83	21.37	39.61	38.82
	> 250	2.37	1.99	19.39	17.76
	> 300	0.38	0.34	6.41	5.28
	> 350	0.00	0.00	1.58	1.27
	> 400	0.00	0.00	0.64	0.54
#Events BG [mg/dL]	< 80	16	29	45	73
	< 70	8	16	34	43
	< 60	4	8	26	30
	< 50	1	3	17	19
	< 40	0	1	5	8
	> 180	336	330	337	335
	> 250	53	43	286	267
	> 300	13	14	132	113
	> 350	0	0	36	28
	> 400	0	0	15	13
#Suspens.	≥ 15 min	473	23	438	53
	≥ 30 min	199	8	209	19
	≥ 60 min	46	0	69	1
	≥ 90 min	15	0	37	0
	≥ 120 min	4	0	14	0
	≥ 180 min	0	0	1	0
#HMS alarms		26	49	72	109
Mean LBGI		0.08	0.16	0.26	0.41
Mean HBGI		4.58	4.04	10.29	9.53
CVGA	Zone count: A	0	1	0	0
	Zone count: B	106	101	61	65
	Zone count: C	2	0	26	18
	Zone count: D	1	7	12	14
	Zone count: E	2	2	12	14
	Circle radius	7.07	7.91	10.94	9.96

Fig. 4.

Proposed asymmetric (left) and symmetric-high (right) weighted MPC. CVGA plot for 111 in-silico adults. Meals: Announced (black ◆), unannounced (blue ). Circles: Centered on mean, standard deviation radius. Zone-counts in Table 2.

6 Clinical Trials

6.1 UCSB Portable Artificial Pancreas System (pAPS)

For clinical trials the proposed control law was deployed within the University of California Santa Barbara (UCSB) portable Artificial Pancreas System (pAPS), a tablet computer based advancement of the laptop based UCSB Artificial Pancreas System (APS) [50]. The pAPS runs on a Hewlett-Packard tablet computer with Windows 7. The control law was coded in Matlab and executed within the Matlab Compiler Runtime environment; exactly the code validated with the UVA/Padova simulator was executed in trials. The pAPS further includes the HMS [48], that provides hypoglycemia alarms to subjects, and dispatches multimedia messages, with salient information in text and plots, to the phones of physicians and engineers, who may be attending the trial or be off-site. The UCSB pAPS was used together with a Dexcom G4 Platinum CGM and Animas One Touch Ping CSII pump. The pAPS communicates wirelessly with the CGM and CSII pump up to ca. 15 meters, allowing subjects fairly free, untethered mobility.

6.2 Trial details

Thirty two subjects completed two closed-loop sessions of ca. 25 hour duration each. In each session subjects were observed from noon. Closed-loop control was initiated by 4pm. Subjects enjoyed simulated outpatient conditions, i.e., the trial location was not a clinic and subjects were nearly free to behave and eat as they pleased. The trial protocol specified three meals (dinner 6–7pm, breakfast ca. 7am, and lunch ca. 1pm) be consumed, capped at 90 gCHO, and announced, with meal-boluses delivered at the start of meal ingestion. Snacks or drinks could be consumed, with subjects free to announce them or not. Each session included an exercise session. Subjects slept at night. Closed-loop control was exited by 6pm the next day. The reader is referred to [31] for trial details and results. Only controller-related highlights and points of interest are provided here.

6.3 Example 1: Fig. 5

Only the data during closed-loop control are available, and closed-loop is initiated during a glucose drop that is driven by insulin infusion prior to closed-loop control. Based on glucose predictions the proposed MPC strategy suspends insulin infusion ca. 5pm, while the glucose level is still comfortably within the safe zone. The pump is suspended for 2 hours, mild hypoglycemia occurs, and insulin delivery is re-initiated ca. 7pm, only once the predicted glucose trajectory points confidently into the target zone. Predicted hypoglycemia triggers HMS alarms; there are multiple alarms because the subject failed to inform the control system of consumed rescue carbohydrates. The pump-suspension and rescue carbohydrates cause a sharp rise, into hyperglycemia, of glucose levels at 7:30pm, causing the control law to deliver in excess of the basal rate. The meal-bolus prior to 8pm causes the IOB constraint to limit insulin infusion to the basal rate, and the IOB constraint loosens, based on the IOB decay curves of Fig. 2, shortly before 10pm. While it may have been beneficial from a glucose control point of view to continue delivering insulin significantly in excess of the basal rate, for outpatient safety the nighttime input constraint limits overnight insulin infusion. The insulin upper bound is time-dependent due to the basal-rate profile of this subject having three overnight levels. Increased insulin delivery in response to the breakfast high at 8:15am drives the glucose level down, and in combination with exercise causes mild hypoglycemia at noon. Note that the pump was predictively suspended, for one hour, starting prior to the descent through the glucose target zone’s lower bound. There are again multiple HMS alarms because the HMS system was not informed of lunch. The effects of IOB constraints are again visible after both the breakfast and lunch meal-boluses, with infusion constrained to the basal rate.

6.4 Example 2: Fig. 6

The noteworthy feature of this example is the pump-suspension from 10:47pm to 3:22am, 4:35 hours in duration. It is noteworthy for two reasons. First, the glucose level during the suspension is mostly within the safe interval [80, 140] mg/dL. The suspension occurs because the glucose level, and the predicted glucose trajectory, are below the glucose target zone, which is elevated during the night. The elevation is not to enforce better overnight control, but to enforce higher safety from nocturnal hypoglycemia due to automated over-delivery. The second noteworthy feature is that the duration of the overnight pump-suspension is extremely long. This is discussed further in Sec. 6.5. The long overnight pump-suspension improves overnight safety but is to blame for the steady rise of glucose levels over the morning. The very low levels of IOB, in combination with breakfast, make such a rise inevitable after a long suspension of insulin delivery. This is an acknowledged weakness of the proposed diurnal target zone approach, but the authors believe that protection from hypoglycemia during sleep justifiably receives precedence. Note that the pump-suspension around 4am is due to a communications disruption and subsequent restart of the pAPS. The time-dependent nighttime insulin constraint, and effects of IOB constraints, are again visible. A sequence of short-lived pump-suspensions due to repeated mild hypoglycemia can also be seen. Two of these events are accompanied by a single HMS alarm each. In this example repeated alarms do not occur because the subject informed the pAPS of the rescue carbohydrates and lunch.

6.5 Discussion

The examples of Figs. 5 and 6 contain pump-suspensions of varying lengths. Within one day Example 2 experienced one very long suspension, and a succession of 3 short ones due to a succession of mild hypoglycemic events. Suspension counts for all 64 clinical trails, corresponding to about 9 weeks of single-person AP use, of the proposed MPC algorithm are listed in Table 3. Crucially, with the proposed control strategy these suspensions, and, importantly, the subsequent pump-resumptions, are driven only by the clinical need as determined by CGM feedback. Note that the value of R̆ plays a crucial role in both suspension and resumption. AP control systems are frequently equipped with ad-hoc logic or supervisors to enforce safety, based on heuristics, not feedback. For example, the Medtronic MiniMed^® 530G, that is being advertised as “Featuring the world’s first breakthrough in Artificial Pancreas Technology”, simply suspends insulin delivery when CGM readings cross from above a threshold in the interval [60, 90] mg/dL that is set by the user, and suspends for a fixed length of time, up to two hours in duration, that is also set by the user. Entering a suspension requires user acknowledgment, and during a suspension the user must interact with the system to achieve a pump-resumption. Furthermore, after a full 2 hour suspension the Medtronic 530G re-starts the pump for at least 2 hours, despite persistent, low CGM measurements.

Table 3.

Suspension counts for 64 trials of ca. 25 hour duration each.

Length [h]	0.5	1	1.5	2	2.5	3	4.5	5
Susp. #	202	87	37	16	6	1	1	0

The CGM trajectories of all 64 trials were re-played through a control system with R̆ = R̂ = 7000, resulting in input trajectories that deliver significantly more insulin during the clinical controller’s suspensions. It is impossible to know what the outcome would have been, but given the satisfactory and safe clinical outcomes (see [31]), it is defensible to speculate that a traditional, symmetric cost function, tuned for hyperglycemia, may have resulted in a greater occurrence of unsafe events.

7 Conclusion

In this work a novel MPC strategy for control of an AP was proposed and described in reproducible detail, and a small selection of control-related highlights from its in-silico testing and clinical operation presented. The proposed strategy is a novel combination of multiple features that have been experimented with independently and elsewhere; a blood-glucose target zone that is diurnally time-dependent, diurnal insulin input constraints, and IOB constraints. The main algorithmic novelty is the use of an asymmetric input cost function. This enforces appropriate insulin delivery suspensions, and subsequent resumptions, based on clinical needs, without relying on heuristics or arbitrary decisions. The presented asymmetric functions are a distinct and differently motivated approach to existing approaches of control of an AP using asymmetric cost functions, which are few.

Biographies

Ravi Gondhalekar’s research interests are in model predictive control, constrained control, estimation, and optimization. At Harvard University he is applying constrained model predictive control techniques to an artificial pancreas that performs automated delivery of insulin to people with type 1 diabetes. Ravi received a PhD degree in informatics in 2008 from the Tokyo Institute of Technology, Japan, and MEng and BA degrees in engineering in 2002 from the University of Cambridge, UK. From 2012 to 2016 Ravi was a Project Scientist at the University of California Santa Barbara, USA, and from 2008 to 2012 he was an Assistant Professor at Osaka University, Japan. Prior to that he held short-term positions at the Massachusetts Institute of Technology, USA, the University of Cambridge, UK, Princeton University, USA, Pi Technology, UK, the Rutherford Appleton Laboratory, UK, and the United Kingdom Atomic Energy Authority, UK.

Eyal Dassau is a Senior Research Fellow in BiomedicalÊEngineering in the Harvard John A.ÊPaulson School of Engineering andÊApplied Sciences. He is also an Adjunct Senior Investigator with the William Sansum Diabetes Center, Santa Barbara, CA and an Adjunct Faculty at the Joslin Diabetes Center, Boston, MA. Prior to that he was an Associate Research Engineer, senior investigator and diabetes research manager in the Chemical Engineering Department and the Institute for Collaborative Biotechnologies at the University of California, Santa Barbara (UCSB). He received his B.Sc., M.Sc. and Ph.D. degrees in Chemical Engineering from the Technion Israel Institute of Technology, Haifa, Israel in 1999, 2002 and 2006, respectively. Dr. DassauÕs research is focused on the development of an artificial pancreas for people with type 1 diabetes mellitus. Dr. Dassau is a senior member of the American Institute of Chemical Engineers (AIChE) and the Institute of Electrical and Electronics Engineers (IEEE) Engineering in Medicine and Biology Society, a member of the American Diabetes Association (ADA), European Association for the study of Diabetes (EASD) and the American Association for the Advancement of Science (AAAS). Dr. Dassau published more than 98 per-review papers on the artificial pancreas and has submitted more than 14 IDEs to the FDA to support artificial pancreas studies. He is a member of the editorial board of the journal of diabetes science and technology and diabetes yearbook published by Mary Ann Liebert, Inc.

Frank Doyle is the John A. Paulson Dean of the Paulson School of Engineering and Applied Sciences at Harvard University, where he also is the John A. & Elizabeth S. Armstrong Professor. Prior to that he was the Mellichamp Professor at UC Santa Barbara, where he was the Chair of the Department of Chemical Engineering, the Director of the UCSB/MIT/Caltech Institute for Collaborative Biotechnologies, and the Associate Dean for Research in the College of Engineering. He received a B.S.E. degree from Princeton, C.P.G.S. from Cambridge, and Ph.D. from Caltech, all in Chemical Engineering. He has also held faculty appointments at Purdue University and the University of Delaware, and held visiting positions at DuPont, Weyerhaeuser, and Stuttgart University. He has been recognized as a Fellow of multiple professional organizations including: IEEE, IFAC, AIMBE, and the AAAS. He is the President for the IEEE Control Systems Society, and is the Vice President of the International Federation of Automatic Control. In 2005, he was awarded the Computing in Chemical Engineering Award from the AIChE for his innovative work in systems biology, and in 2015 received the Control Engineering Practice Award from the American Automatic Control Council for his development of the artificial pancreas. His research interests are in systems biology, network science, modeling and analysis of circadian rhythms, and drug delivery for diabetes.