Biomedical Signal Processing and Control

Artiﬁcial pancreas (AP) systems for people with type 1 diabetes (T1DM) combine the use of a smart insulin pump with a Continuous Glucose Monitor (CGM) and a control algorithm to improve the regulation of glycaemia. Based on the extensive clinical evidence provided by the main research groups in the area, a hybrid control algorithm combining insulin meal boluses and glucose feedback action has been recently approved. However, this sort of algorithms should be reﬁned especially during the postprandial period. In turn, fully closed-loop control strategies have to be further developed. In either case, intensive in vivo validation is necessary to ensure the viability of the proposed strategy as an effective method to treat T1DM patients. In this paper, a safety layer called SAFE loop [1] is reformulated to be employed during clinical trials in two different ways: the time enable mode to gradually activate the closed-loop control after an insulin meal bolus in hybrid conﬁgurations; and the amplitude enable mode to activate the full closed-loop control as long as the insulin infusion does not exceed the conventional therapy to a given extent. The SAFE module decides the activation of the controller as a function of a constraint on the insulin on board (IOB). In the case of the Time Enable, this results in the use of a constant restriction on the IOB, whereas in the amplitude enable it results in the use of a time-varying IOB constraint. Both operation modes are evaluated in silico using broadly accepted high-order models and the results contrasted with the ones obtained without the SAFE protection.


e in the bloo
-BG) which can cause micro and macro vascular complications.

Nowadays, the treatments that help T1DM patients stay within the limits of normoglycemia (BG ∈ [70-180 mg/dl]) are multiple daily injections (MDI) and continuous subcutaneous insulin infusion (CSII) using an insulin pump.This latter one allows the addition of control algorithms to regulate the insulin delivery by the pump with the aid of continuous glucose monitors (CGM).The algorithms mu t be validated in silico and then tested in humans in a clinical trial.

The subcutaneous route introduces several restrictions on the achievable performance of an artificial pancreas system.This includes:

• The patients response to insulin is slower than to meal intake.

• Large perturbations (the meals).

• No negative action (insulin can be delivered but not drawn out).

• Variation in significant parameters of the patient (such as insulin sensitivity).

The e restrictions together with technological limitations do not allow successfull fully automatic gycaemic control yet.For these reasons, nowadays the great majority of the clinical trials evaluate hybrid control strategies, i.e. a combination of an insulin bolus (which is calculated from the information of the meal to be ingested) and a control algorithm that delivers insulin during the late postprandial period [2][3][4][5].Nonetheless, achieving full closed-loop control remains as the main goal.Completely automatic algorithms have been evaluated in randomized trials as well, but mainly in the nocturnal period, when no perturbations are present [6,7].Only a few closed-loop trials during both day and night have taken place [8,9].Therefore, it is important to develop measures to test in vivo both hybrid and automatic control therapies in a safe environment.

Differen control strategies are being developed and tested by the scientific community, mainly based on PID [10][11][12], Model Predictive Control (MPC) [13][14][15] and Fuzzy Logic (FL) [16][17][18].Hypoglycemia is usually a result of an overestimation of the insulin dose by the controller (the delay in the systems response incites insulin stacking).The use of constraints on the amount of insulin active in the body (insulin on board -IOB) to prevent this insulininduced hypoglycemia has proven to improve glycaemic control both in silico [19,20] and in vivo [21].These constraints can be addressed by an MPC control strategy [21].With MPC controllers the constraint is taken into account explicitly during the controller's design.In contrast, there are other techniques that allow the main controller to be designed separately without including IOB limitations and to then add the safety layer that accounts for the desired constraint (two-step design) [1].This way, potentially simpler controllers that would not be able to handle IOB constraints can incorporate them as a safety mechanism.

Recently, a ne method using sliding mode control was introduced called the SAFE (safety auxiliary feedback element) algorithm [1], which was inspired on the sliding mode reference conditioning (SMRC) technique originally proposed by some of the authors of this work [22].This algorithm works as a safety layer adding an IOB constraint around any main controller (including MPC) and has shown to reduce the number and severity of hypoglycemic events (BG < 70 mg/dl) [23].This strategy has been successfully validated in clinical trials as part of the controller [24,5].

In this paper, t e IOB constraint imposed by the SAFE algorithm is designed for its use in clinical trials, giving rise to a safe mechanism for testing both hybrid and fully closed-loop controllers in vivo.To this end, two different modes of operation are proposed.One is designed to work with hybrid controllers and the other one is designed to be used with fully automatic controllers.The first one, called Time Enable, is to be used with hybrid configurations.This mode is the classical SAFE loop previously proposed [1,23] where a constant IOB constraint is used.In this work however, it is reinterpreted to be used in clinical trials.It provides a criterion to establish the required IOB constraint and to, from that point on, safely decrease the open-loop action to make way to the closed-loop controller.It also works as a safety mechanism against mistuned controllers, reducing the severity and duration of potential hypoglycemic events.The second one, called Amplitude Enable, is focused on fully closed-loop clinical trials.This operation mode is designed to ensure that the controller action will not exceed to a given extent the traditional therapy's insulin infusion.In this case, the constraint on the IOB is based on the time-varying IOB profile that would result from an open-loop treatment for the same meals.Both algorithms are intensively evaluated in silico using the FDA (Food and Drug Administration) approved UVa/Padova simulator [25,26] under inter-and intra-patient variability.The intake of meals of mixed composition is also considered [27].


The SAFE algorithm

Fig. 1 shows a block diagram of a generic glucose control loop with the SAFE algorithm added.The main control loop may have any type of glucose controller, even non-linear.For hybrid configurations, the signal 'OL Bolus' represents the insulin bolus that is administered when the patient announces a meal (feedforward action).For a fully closed-loop therapy, 'OL Bolus' is zero.

The SAFE

gorithm is aimed at
reducing the risk of hypoglycemia.To achieve this, it decreases the gain of the glucose  controller if a given upper constraint on the IOB ( ĪOB) is violated.Fig. 2 shows a detailed block diagram of the SAFE algorithm.

Due to its software-based natur , the SAFE block has a much smaller sampling period (T Ssafe ) than the rest of the controller (T S ).Within each T S , the SAFE algorithm predicts the evolution of the IOB.This is used to calculate the adaptive gain that should multiply the controller output in the next sampling period T S (for greater details see [23]).

The first block that constitutes he SAFE estimates the IOB from an IOB model and the insulin being delivered.The IOB model used here is a two-compartment dynamical system (although any other dynamical model or estimator could be used for this purpose).The set of equations describing it are the following:
⎧ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎩ dC 1 dt (t) = u(t) tments, u(t) is the total insulin that is administered to the patient, and K DIA is a constant that represents each person DIA (duration of insulin action).The output of this block is the estimated IOB.A switching law is then defined from the IOB in order to modify the main controller gain so that the limit ĪOB cannot be violated by anything other than an insulin bolus.Its goal is to avoid surpassing the IOB limit due to the feedback action.The switching law proposed in this paper is simply:
ω(t) = ½ 0 if < 0 1 if ≥ 0 (2)
where
(t increase the IOB above ĪOB, a high frequency switching in ω will occur, called sliding mode.The signal ω is then averaged, yielding which is the factor (between 0 and 1) that will scale the controller output until the feedback action stops pushing the IOB upwards.Note that, in this configuration, the 'OL Bolus' is outside the SAFE loop and therefore not affected by the scaling factor regardless if it violates the IOB constraint or not.

Two different modes of operation are p oposed for the SAFE algorithm to test both hybrid (with meal announcement) and fully closed-loop (without meal announcement) controllers in clinical trials with humans.


Main controller under testing

The SAF

algorithm can work around any
ain glucose controller.In this study, for illustrative purposes and without loss of generality, the main controller under testing will be the PDBasal.This is the classical PID algorithm [28] where the integral term is replaced with the basal insulin from the open-loop therapy.

The PDBasal controller output is computed using the following equation:
u c (t) = k p h e(t) + d de(t) dt i + u ba :
k p = 60 d I TDD 1500 (5)
I TDD is the tot t needs a day [29] and d (t) has a nominal value of 90min during the day and 60min during the night [28].

When testing this controller in a hybrid configuration, the total insulin delivered is the sum of u c (t) and the open-loop bolus ('OL Bolus') calculated as:
OLBolus = k OL • I : CHO • CHO(6)
where I carbohydrate ratio, CHO is the amount of carbohydrate intake and k OL is a factor that scales the size of the traditional insulin bolus.


Time enable mode

In this section, the

me enable mode is
described and evaluated in silico in order to illustrate the benefits introduced by this strategy when testing hybrid-loop controllers in vivo in a supervised clinical trial.


Description

In the time enable mode, t

SAFE gradua
ly enables in time the closed loop action after a meal bolus.More specifically, after an early postprandial period in which a meal has been exclusively

compensated by the open-loop action, the Time Enable allows the controller to resume the insulin delivery gradually and automatically (with its gain being attenuated as needed according to the imposed constraint on the IOB) until the closed-loop is completely enabled ( = 1).In this work, the SAFE is reinterpreted as a tool to protect the patient from severe hypoglycemia in clinical trials.Then, if necessary, allows safe retuning of the main glucose controller, eventually freeing the controller from the need of the SAFE protection.

From the previous section, we should expec the following to happen after a meal intake: first, when the insulin bolus is administered, the ĪOB is inevitably surpassed thus making = 0.As a result, the controller output should be 0, so no extra insulin is administered and the control system operates in an open-loop fashion.The IOB decreases naturally as the insulin is absorbed according to each patients DIA.After a time t OL , the IOB reaches the ĪOB and the SAFE starts switching internally between ω = 0 and ω = 1.The SAFE output (which is the average of ω along each sample time) will be strictly a value between 0 and 1.Then, the SAFE allows the controller to deliver insulin scaled by .The duration of this process will be called t SAFE .When finally the controller response does not cause the limit to be exceeded anymore the SAFE becomes inactive.This initiates the period of time called t CL .In this way, we can identify three distinctive phases: open-loop, transition and closed-loop.

Fig. 3 illustrates the operation of the algorithm (solid line) on the patient Adult 1 of the FDA approved UVA/Padova in silico simulator when facing a meal with 60g of carbohydrates.The controller under testing is the PDBasal (Eqs.( 4) and ( 5)) plus the meal insulin bolus (6) scaled by k OL = 0.7.For the sake of comparison the controller response without the SAFE protection is shown with dashed line.The grey area is the target glucose range (70-180 mg/dl).The meal starts at time t = 10 min.At this moment, the insulin bolus is administered, so the IOB increases to its maximum value almost instantly.As the ĪOB is surpassed, the adaptive gain switches to 0 and remains there for the entire t OL , which forces the controller to deliver no insulin and also cuts the open-loop's basal insulin, making it similar to a superbolus [30].Note however that the SAFE can also be set to not suspend the basal insulin delivery during this period.Then, at t = 2.2 h, the ĪOB is reached, which makes the fast switching between 0 and 1 in ω begin, thus allowing the controller to administer insulin gradually without exceeding the constraint (0 < < 1).At approximately t = 5.8 h, the t SAFE ends and the controller is left to act freely ( = 1).In contrast, when the SAFE is not used, the PDBasal delivers a large quantity of insulin right after the open-loop bolus.The result is lower postprandial glycaemic values, as well as a larger glucose excursion and a longer transient state.This is due to the overestimation of the insulin dose due to the superposition of the controller action with the scaled meal bolus.The double peak in the glucose concentration present in this patient reinforces the insulin overdose.


In silico analysis

There are several simulation environm

ts developed by dif
erent research groups [26,31,32].In this work, all the simulations are made on the commercial version of the UVa/Padova simulator.

The simulations shown in this subsection were made for the 0 patients (10 adults, 10 adolescents and 10 children) to show inter-patient variability effects.


ĪOB sweep: setting an initial IOB constraint

The simulati

scenario shown here consists in a one meal test of
80 g of pure CHO in an observation period of 16 h.The 10 adult patients are used.Here, an ĪOB sweep is performed.On one end, the ĪOB min is set to be equal to the basal IOB of each patient.On the other end, the ĪOB max is set to the maximum value of IOB obtained when an open-loop bolus is delivered for a specific meal (this value will be dependent on the CHO amount and k OL ).These two values are shown in Fig. 4. Six intermediate values of ĪOB are taken in order to explore the effects of different limits.

Table 1 shows the results of the ĪOB sweep when using k OL = 1.It displays the mean t OL , t CL , t SAFE , time in hypoglycemia (t hypo ), time in normoglycemia (t normo ) and time in hyperglycemia (t hyper ) obtained for each simulation.This table shows that the less restrictive ĪOB 0 s result in the most amount of hypoglycemic events.This is because the higher the ĪOB, the longer the superposition of both open and closed-loop therapies, which are tuned to operate separately.On the other hand, when the SAFE is too restrictive, the amount of insulin administered is less than the open-loop therapy, as the controller can only subtract from the basal insulin, resulting in an increase in hyperglycemia.Nonetheless, choosing a restrictive IOB constraint could be an appropriate choice.For example, it can be seen from these results that if the open-loop insulin bolus is used in its entirety (k OL = 1), the ĪOB should be set to ĪOB min in order to obtain the most time in normoglycemia.

However, it is common in practice to deliver a smaller meal bolus than in the open-loop therapy (for instance, the use of k OL = 0.5 has been clinically tested [33]) in order to avoid excessive insulin stacking without reducing closed-loop action (the consequence of reducing it would be that the controller is less robust to variations in meal composition, insulin sensitivity, etc).To illustrate this case, simulations for the sce ario described previously were made using an intermediate value of k OL = 0.7 and k OL = 0.5.The results of these simulations are displayed in Tables 2 and 3.It can be noted that when k OL = 0.7 (Table 2) is being used, setting the ĪOB t

a value halfway between ĪOB min and ĪOB max ( ĪOB 5
) maximizes the time in the normoglycemic range.Also, using ĪOB 5 as the IOB constraint results in t CL = 14.37 h, meaning that the controller regulates glycaemia freely 89.8% of the total simulation time.Then, Table 3 shows that for k OL = 0.5, the normoglycemic range is maximized when ĪOB is set to ĪOB 7 .For this case, t CL = 14.48 h which represents 90.5% of the total simulation time.

In conclusion, as the open-loop bolus is decreased to make way to closed-loop control, the ĪOB should be raised from ĪOB min (initially for k OL = 1) in order to achieve the most time in normoglycemia while maintaining a reasonable t CL .


k p Sweep: protection against mistuned controllers

Again, the simulation scenario shown here consists in a one meal test of 80 g of pure CHO in an observation period of 16 h and the 30 patients are used.Here, a k p sweep is performed in order to simulate the consequences of controller mistuning.The controller gain is set to 50%, 75%, 100%, 125%, 150%, 175% and 200% of its nominal value.The k OL used is k OL = 0.7, so the ĪOB is set to ĪOB 5 based on the results obtained in the previous subsection.The simulation is repeated for the same scenario but using the hybrid PDBasal without IOB limitation.

Table 4 shows the results of the k p sweep.It displays the mean t OL , t CL , t SAFE , time in hypoglycemia (t hypo ), time in normoglycemia (t

ormo ) and time in hyp
rglycemia (t hyper ) obtained for each simulation.It should be noted that a change in k p does not affect the t OL , but it does have an impact on the t SAFE .For higher controller gains, the t SAFE is longer, as a more aggres

ve controlle
will be more restricted.The right six columns of this table evidence that the Time Enable mode makes the blood glucose excursion less sensitive to controller gain changes.Therefore, it can be stated that the utilization of the safety layer allows testing a controller of dubious tuning without exposing the patient to the longer hypoglycemic episodes that are present when the Time Enable mode is not being used.


Amplitude enable mode

In this section, the amplitude enable mode is described and eval ated in silico in order to illustrate the benefits introduced by this strategy when testing full closed-loop controllers in vivo in a supervised clinical trial.


Description

This operation mode consists in using a factor (ˇ > 1) of the IOB profile that would result from an open-loop therapy as the constraint on the IOB (i.e.: ĪOB(t) = ˇ * Open − Loop IOB Profile).This method is to be used with fully automatic configurations.Since it is thought for its use in clinical trials, the composition of the patients meals and the corresponding insulin boluses are known beforehand.This way, the ĪOB(t) can be computed and programmed into the insulin pump before the trial begins.

Using the open-loop IOB profile (or a bigger-than-1 factor of it) as the SAFEs constraint ensures that the controller will not deliver much more insulin than what the open-loop therapy would, thus protecting the patients from hypoglycemic events and allowing a fully closed-loop algorithm to be tested safely.As long as the closedloop performance with the IOB constraint protection is acceptable, the limit can be relaxed and set as a greater factor of the IOB openloop profile.This method works as follows: after a meal, the glucose level rises rapidly and so does the controller input.The controller then administers a large quantity of insulin until the IOB meets the timevarying ĪOB(t).At this point a rapid switching between 0 and 1 according to Eq. ( 2) begins and lasts until the controller action does not cause the limit to be exceeded.The closed-loop action is enabled as long as its active insulin does not exceed a given factor of the one corresponding to the conventi nal therapy.

Fig. 5 shows this behavior (solid line) for the patient Adult 1 of the UVA/Padova simulator when facing a meal with 80 g of carbohydrates.Here we can see that after the meal is ingested, the controller starts to respond slowly and increases the IOB until it reaches

he established ĪOB
dash-dot line) at t = 2.8 h.From this point, the IOB is limited until approximately t = 9 h, when the controller is left to deliver insulin without the intervention of the safety layer.The dashed line corresponds to the same scenario controlled with the PDBasal without IOB constraint.The result is a larger glucose excursion and a late postprandial hypoglycemic event.

In contrast with the time enable mode for hybrid controllers, here the sliding mode establishes in the late rather than in the early postprandial period so, in this mode of operation, the compensation of the meal is made by the controller instead of the open-

op insulin bolus.


In silico analysi
In this subsection, the amplitude enable mode is evaluated in silico.First, the nominal model of the patients were simulated in order to illustrate the performance of the proposed operation mode.Then, a more realistic scenario is used to ev luate the robustness of the proposed method (including variation in the insulin sensitivity and in the meal composition).The results are compared with the controllers (PDBasal and hybrid PDBasal) without IOB limitation.The simulations shown in this subsection were made for the 10 adult patients of the commercial version of the UVa/Padova simulator to show inter-patient variability.


Simulations under nominal conditions

The simulation scenario consisted in a 3 meal test adding to 200 g of CHO to replicate a usual day (break ast: 40 g at 7 h, lunch: 80 g at 12 h and dinner: 80 g at 19 h).The observation period is 24 h from 6 am to 6 am of the following day.

First, a k p sweep was performed for the PDBasal to show the consequences of different fully closed-loop controller tunings with and without limitation in the IOB.The ĪOB was set with ˇ = 1.15 (i.e., 115% of the open loop IOB profile).A bigger-than-1 ˇ was chosen because the closed-loop controller will never respond to a meal as fast as an open-loop bolus would, given that there is no meal announcement.The proportional gain k p was changed to 100%, 200%, 400%, 800%, 1600% and 3200% of its nominal value (given by Eq. ( 5)).

The results of these simulations are shown in Table 5.It displays the mean time spent in hypo, hyper and normoglycemia for the different values of k p , both with and without IOB limitation.It can be observed that when the SAFE layer is being used, the risk of hypoglycemia is significantly reduced, even with a disproportionally large gain k p .It should be kept n mind that these results are not to be interpreted with the aim of increasing the time in the normoglycemic range.However, they reveal the robustness of the Amplitude Enable mode in preventing hypoglycemia when facing severe controller mistunings.

Fig. 6 compares the glucose evolution over time for adult 10 of the UVa/Padova simulator obtained with and without the safety layer.In both cases, a higher k p indicates a more aggressive controller, which means larger amounts of insulin delivered and lower glucose levels.This figure illustrates clearly how the patient is protected from dangerous controller tunings that could result in severe hypoglycemia.

A second

t of simulations was made but this time,
n addition to considering the different values of k p , the constant ˇ was changed from 1 to 1.5 with a step of 0.05 yielding to 66 different combinations of k p and ĪOB.The results are displaye in Fig. 7.The crosses correspond to the simulations using the Amplitude Enable mode and the circles to the ones without IOB limitation.An important conclusion that can be drawn out from these simulations is that even if the amount of CHO is over stimated (resulting in a more relaxed ĪOB), the time-varying IOB limit still significantly reduces the risk of severe hypoglycemia when the controller is not properly tuned.


Simulations under challenging conditions

In this subsection, a new scenario is used in order to evaluate the performance of the amplitude enable mode under more challenging conditions.To this end, the following items were considered:

• A circadian variation of insulin sensitivity (IS) was taken into account (intra-patient variability).• Instead of using pure CHO meals, the meals were replaced with mixed meals with different nutritional composition and absorption rates [27].

In order to take into account a more ealistic scenario, diurnal variability of the system parameters that describe insulin sensitivity (IS) (V mx , k p3 ) of the glucose-insulin model proposed in [31] was considered, following the work of Visentin et al. [34,35].The intra-day variability for the time-varying parameters of IS was implemented as an almost step-wise-line signal that varies three times a day: at 4, 11 and 17 hours.Each in silico subject was randomly assigned to a time-varying IS class profile, as presented in [34].The parameters involved with IS varied between 100% and 60% with a multiplicative random noise, described by a normal distribution N(, ), with = 1 and = 0.2.

The open-loop basal insulin and the I:CHO ratio used to get ĪOB are adjusted accordingly.The basal rate of the patients was adjusted to maintain in steady state their fasting glucose, so two levels were set: one when the IS parameters are at 100% and another when they are at 60%.The noise was not considered for the basal insulin computation.The change of basal rate is produced two hours before the change of sensitivity was defined.The different I:CHO for each   The scenario consisted in 3 mixed meals listed in Table 6.Note that the chosen meals have similar CHO amounts as the ones in the previous scenario.Again, the simulations w

e made for t
e 10 adult patients, in a 24 h observation period from 6:00 am to 6:00 am of the following day, with and without the amplitude enable mode.The same values of k p and ˇ were considered.Fig. 9 shows the mean time spent in hypoglycemia versus the mean time spent in hyperglycemia.The crosses correspond to the simulations using the amplitude enable mode and the circles to the ones without IOB limitation.From these simulations it can be concluded that even under this more challenging scenario, the use of the IOB constraint for fully closed-loop control proves to have consistently solid performance in reducing hypoglycemic events when dealing with severe controller mistuning.


Conclusions

The two modes of operation of the SAFE algorithm to prevent hypoglycemia during clinical trials were evaluated in silico under different simulation scenarios.In hybrid controllers, the time enable mode proved to be a convenient method to