Fault Tolerant Strategies for Automated Insulin Delivery Considering the Human Component: Current and Future Perspectives

Abstract

Automated Insulin Delivery (AID) are systems developed for daily use by people with type 1 diabetes (T1D). To ensure the safety of users, it is essential to consider how the human factor affects the performance and safety of these devices. While there are numerous publications on hardware-related failures of AID systems, there are few studies on the human component of the system. From a control point of view, people with T1D using AID systems are at the same time the plant to be controlled and the plant operator. Therefore, users may induce faults in the controller, sensors, actuators, and the plant itself. Strategies to cope with the human interaction in AID systems are needed for further development of the technology. In this paper, we present an analysis of potential faults introduced by AID users when the system is under normal operation. This is followed by a review of current fault tolerant control (FTC) approaches to identify missing areas of research. The paper concludes with a discussion on future directions for the new generation of FTC AID systems.

Background and Motivation

A closed-loop (CL) automated insulin delivery (AID) system, or artificial pancreas (AP), is composed of a minimum of 3 elements ¹ : a continuous glucose sensor and signal transmitter commonly referred to as continuous glucose monitor (CGM), a continuous insulin infusion device, and an algorithm to make changes in the insulin delivery rate in response to sensor measurements. The algorithm does not necessarily reside on a separate device, such as a mobile phone or pump receiver/transmitter, but can also be on the pump body itself.

The fourth component is the patient. In terms of process control, the patient is both the plant to be controlled and the plant operator. Many failures can come from the plant itself and the way the plant is operated. The impact of having the human-in-the-loop (HitL) must be considered when designing any blood glucose (BG) control system. ² Thus, in the control system design specifications, disturbances from inadequate system management should be considered and those that cannot be handled by a feedback control loop should be treated as faults and a fault tolerant control (FTC) scheme should be designed. Similarly, large variations in patient dynamics that cannot be correctly compensated for by the controller must be considered in the fault-tolerant design. New generations of AID systems, to be fully automatic and autonomous, will need to incorporate FTC and personalization strategies that consider the fact that the patient is at the center of the system and in the control loop. ³

This paper analyzes and discusses different sources of faults since the patient is in the loop. Methods for detecting and identifying faults are proposed as well as different approaches for FTC. Finally, a discussion is presented on the improvements that new generations of AP systems should contain to be fully autonomous.

Patient Related Faults and Disturbances

Ideally, AID systems aim to relieve the patient of decision-making and disease management so that they can lead a life as closely as possible to that of a healthy person. However, several factors make this impossible for currently commercialized AID systems for the time being, as they can lead the system to a situation of failure. These failures can be due to psychosocial factors, human factors, and physiological changes.

Current commercial AID systems do not consider the particular needs of patients, providing a one-size-fits-all solution. Most of them are designed/tuned with a low tolerance for hypoglycemia and thus may have longer periods of hyperglycemia than if more tightly tuned. ⁴ However, psychosocial factors impact the way users use AID systems. Thus, some patients may stop wearing the devices for body image reasons, significantly reducing the CL action time. Others may adopt a more passive attitude towards diabetes self-management, even compromising their safety. ⁵ On the other hand, highly motivated type 1 diabetes (T1D) individuals with much experience may be able to tightly control their BG through close attention to meal boluses and the effects of exercise; therefore these individuals can be quite frustrated by the performance of an AID system and seek ways to “override” the system, by (eg,), placing the system in manual mode and providing a manual insulin bolus ² ; or over-estimating their meal carbohydrates so that a larger bolus is given. ⁶

Highly probable patient faults come from user interaction with the system. Patients may introduce faults into the insulin pump, for example, by changing the catheter later than recommended by the manufacturer, which may eventually lead to actuator failure. CGMs can also be miscalibrated, either due to error in reporting the SMBG value at the time of calibration, or problems with the capillary blood sample itself, due to contaminants in the sample (skin not washed beforehand, for example). It should be noted that the newest generation of CGMs is “calibration-free.” Disturbances introduced by the patient can also lead to a faulty system state. For example, patients may override the algorithm (bolusing in manual mode, deliberately misestimating carbohydrate estimates), forget to announce meals (converting a measurable disturbance to unmeasured) or miss a meal.

Among the most common disturbance faults that come from patient’s behavior are missed meals and unexpected exercise. Every fourth meal may have a missed or late bolus associated with it,^7,8 resulting in a significant reduction in time in range and an increase in postprandial peak. Also, in many cases, patients are not able to accurately calculate the amount of carbohydrates they take. ⁹ It has been shown that not only carbohydrates influence the calculation of the insulin bolus but also protein can increase insulin requirements by 50%. ¹⁰ Unannounced exercise is another major source of system disturbances. First, because its effect is highly variable depending on the type of exercise and its intensity. ¹¹ Secondly, because the patient may try to compensate for the effects of exercise on glycemia, for example, by taking carbohydrates but without notifying the controller. Thus, the result is 2 controllers operating simultaneously without being aware of each other.

In addition to the previously discussed, we know that insulin requirements change by the minute and that, in most cases, these can be compensated for by the feedback controller or by basal adjustment strategies. However, some physiological changes that affect the dynamics of the glucose-insulin system may involve large variations in insulin sensitivity that cannot be handled by a simple controller.

Illness, stress, some medications, or sleep apnea can produce major physiological changes such as increased insulin sensitivity, increased rate of glucose disposal, and/or decreased glucose production, pushing the CL controller to extreme situations. Variable hormonal responses due to puberty, menstrual cycles, and menopause also cause major physiological changes. The effects of pregnancy in women with T1D are not fully understood. ¹² While requiring strict glucose control, hormonal changes throughout pregnancy can lead to large variations in insulin sensitivity, causing long and dangerous periods of hypoglycemia.

While some studies show that AID systems can control BG in the face of moderate alcohol intakes, more general studies on the impact of alcohol on AID systems in normal living conditions are lacking. In addition, the effects of heavy alcohol consumption on AID systems remain to be investigated. High alcohol consumption is known to contribute to disease complications ¹³ while reducing patients’ ability to manage their disease or operate an AID system properly.

Fault Mitigation and Fault Tolerant Control Approaches

AID systems performance and safety can be affected by how users manage and interact with the system. This has been a common situation in many practical control applications in which control systems work with human operators.^14,15 Current systems under development^16,17 are designed for people with diabetes who are unlikely to have experience with control systems technology. For this reason, fault tolerant systems that take special attention to user actions should be designed, validated, and incorporated into commercial devices.

Traditional FTC systems are usually composed of at least 2 layers that work cooperatively, namely execution and supervisory layers. The execution layer is composed of the typical feedback loop with the controller, plant, actuators, and sensors. The supervisory layer consists of a diagnostic block, which continuously monitors the execution layer to detect, identify, locate, quantify and isolate faults; and a decision block that performs the necessary corrective actions to ensure performance and safety.

In the Figure 1 scheme, a fault occurring in the T1D patient ( $f_p$ ) that is detected will be treated by the controller if the fault is recoverable, that is, there is a controller configuration that solves the controller redesign problem in the faulty state. That means that a new set of controller parameters or even an entirely new control approach will be used in the faulty state.

Figure 1.

General FTC AID architecture.

Nonetheless, a FTC AID system not only has to detect faults appearing in the plant but also in the actuators ( $f_u$ ), sensors ( $f_s$ ) and controller ( $f_c$ ) itself as the effect of a fault in any of these components is propagated throughout the system. Fault detection algorithms for hardware-based CGM sensors^18-26 and insulin pump actuators^27-34 have been successfully investigated, however, currently available AID systems do not usually include all these features. Plant faults can usually be alleviated by using either robust controllers or an active reconfiguration system that changes the controller according to the faulty state. These types of faults mainly change the input-output relationship of the system and can usually be addressed by the controller, ensuring safety but with degraded performance.

One of the burdens for achieving fault tolerance in AID systems is the limited number of available sensors and actuators. ³⁵ In typical commercial configurations, there are only one insulin pump and one CGM sensor. ³⁶ Therefore, fault tolerance must be achieved employing analytical redundancy, where information from online CGM and mathematical models is used. Particularly, state estimation is a popular model-based strategy to accomplish fault detection and identification.^37,38

Many research AID prototypes incorporate to some extent algorithms that monitor the system by estimating model states, parameters, or external disturbances. These approaches have been mainly used for control design rather than FTC and HitL interactions. The basic uses of such approaches are: (1) estimating insulin on board (IOB) or plasma insulin concentrations,^39,40 (2) glucose rate of appearance after meal estimations,^41-43 (3) exercise detection,^44-46 and (4) general state estimation for prediction and control.^47-52

Insulin Fault Control

Insulin estimation has become one of the must-have tools for any AID system because direct insulin measurements are currently not possible. These estimations allow to continuously monitor the insulin state and avoid controller over-actuation that may lead to hypoglycemia. ³⁹ Most control algorithms include this as a module to enhance safety by having upper constraints in admissible insulin infusion and for prandial bolus computations.^53-56 However, they may also be a major limiting factor in the achievable performance if tuned too conservatively, leading to user frustration when CL systems react too slowly to high BG concentrations. ⁵⁷ AID systems should take advantage of these algorithms to enhance safety when the user is commanding the system by providing comprehensive insulin advice. Insulin concentration estimation should remain uninterrupted regardless of the system operation mode and be used to safely initialize or resume the selected therapy. Detection of unannounced insulin injections should also be a fundamental feature of these systems, with appropriate controller accommodation.

Meal Related Patient Faults

Meals are one of the major disturbances that affect AID systems and have centered the most attention in both published research and clinical trials. ⁵⁸ The Juvenile Diabetes Research Foundation’s AID system design roadmap, ⁵⁹ included a specific design step in which meal announcements were completely removed. This led to several designs, so-called fully CL systems, that operate without meal information.

This is attractive from a control point of view, as these systems decouple the user from the control system, while promising ease of use. However, they still underperform when compared to hybrid AP strategies with meal advertisements and can lead to user dissatisfaction. Monitoring and discriminating user meal action announcements together with the rate of absorption estimations should allow systems to use reliable patient information, allowing for effective feedforward meal control, and providing a better compromise between safety and performance. Several algorithms detect when a meal has been consumed, largely based on glucose rate-of-change greater than a threshold value, and therefore become more aggressive with insulin delivery.^52,60-63 Indeed, knowledge of typical daily eating patterns can be used to anticipate when meals are likely to be consumed and include that probability in future predictions of BG levels.^50,51,64-66 While these anticipatory algorithms lead to good CL performance, providing a premeal bolus yields a significant improvement in meal disturbance rejection.

Exercise Related Patient Faults

Exercise is another important disturbance that AID systems need to be safe against.^67,68 It has been shown that exercise greatly affects the BG system with various types of effects. ¹¹ Patient actions, such as the use of carbohydrates as a preventive control action or the adjustment of insulin infusion are essential for safety.^11,53,69,70 Exercise detection methods allow control systems to reconfigure themselves to some extent.^44,46,71-74 Usually, recommendations against exercise raise BG levels to avoid post-exercise hypoglycemia. The system must work cooperatively with the patient so that these feedforward actions are not seen as a disturbance to be rejected by the control system itself. Physical activity may alter insulin sensitivity for a prolonged time, thus methods for controller reconfiguration or tuning adjustment should be incorporated into AID systems to compensate for these changes.

Additional Control Actions for Fault Tolerant Control

Although there is no current formulation of glucagon that is stable for a long time at body temperature, many clinical studies have used insulin and glucagon. El-Khatib et al ⁷⁵ use a PD controller that is active under certain glucose concentrations to manipulate glucagon. Insulin is administered based on an adaptive MPC strategy with a very short prediction horizon, making it similar to a PID controller. Russell et al ⁷⁶ present results for a 5-day study with 20 adults and 32 adolescents. Blauw et al ⁷⁷ stress the advantages of using a single integrated device (rather than separate smartphones and pumps) to manipulate both insulin and glucagon in a 4-day study involving 10 subjects. El-Khatib et al ⁷⁸ study 39 subjects in a dual-arm at-home study of 11 days in closed-loop and 11 days in conventional therapy. Haidar et al ⁷⁹ compared dual-hormone, single-hormone and sensor augmented pump therapy in 23 adults. The iLet system^80,81 delivers both insulin and glucagon, but the first commercial version will likely administer only insulin. Wilson et al ⁸² present results for the Oregon Artificial pancreas, with and without glucagon, in a 76-hour outpatient study with 23 participants. Wilson et al ⁸³ provides a comprehensive review of the potential benefits of using dual hormone systems, concluding that the use of glucagon contributes in lowering hypoglycemia.

While glucagon acts to directly increase BG, another hormone, amylin (or pramlintide) can be used to delay gastric emptying to decrease the rate-of-change of glucose after a meal. Weinzimer et al ⁸⁴ use premeal pramlintide boluses, combined with PID feedback manipulation of insulin to show improved post-prandial glucose control.

While it is certainly useful to have the additional “degrees of freedom” by manipulating hormones, such as glucagon and pramlintide, in addition to insulin, the major disadvantage is that the additional inputs can fail, an important fault detection consideration. Additionally, most of the AID systems with multiple manipulated hormones are still in an early stage, still requiring more exploration of its benefits before commercialization.

Other Signals for Fault Tolerant Control

Before CGMs were available, there were several devices developed to warn individuals of impending hypo- and hyperglycemia. Howsmon and Bequette ⁸⁵ review devices that use a variety of biosignals, including electroencephalography, electrocardiography, skin galvanic resistance, diabetes alert dogs, and CGMs.

To reduce the risk of hypoglycemia it is desirable to provide exercise information as part of an automated insulin delivery strategy. Stenerson et al ⁸⁶ incorporate heart rate and an accelerometer into a predictive low glucose suspend (PLGS) system, but find little additional benefit due to the use of heart rate. Turksoy et al ⁴⁶ use energy expenditure and galvanic skin resistance as additional sensor inputs to improve BG control during exercise. Breton et al ⁸⁷ add heart rate to a MPC strategy to improve BG regulation during exercise.

Recognizing and predicting future activity allows current actions based on likely future actions, such as using GPS location or a calendar entry to predict someone is about to eat or exercise. Navarathna et al ⁸⁸ review the use of wearable devices, and show how to use them to predict patient activity improve control of BG levels in people with T1D.

Discussion

The design of fully automatic and autonomous AID systems requires incorporating the analysis of how the patient, which is the user, affects the system. As the patient will be wearing the system and operating it, it is of utmost importance to design FTC systems that consider the patient’s actions. While many research AID prototypes have explored mechanisms and algorithms to minimize the impact of CGMs, insulin pump and human induced faults and disturbances, currently commercialized systems are still lacking the incorporation of these tools.

The main research effort from the point of view of patient faults involves the detection and quantification of 2 common human activities: exercise and meals. Meals are the primary disturbance that CL systems are aimed to reject. Announced meals or exercise allow feedforward control and/or mitigation actions, which can be used to counteract disturbances better than fully CL systems. ⁸⁹ However, this implies that the patient has to feed critical information into the control loop and therefore the overall performance of the controller may be compromised if the patient does not provide correct information.

The patient is also the operator of the control system and is in charge of the system maintenance and supervision. Thus, the patient is required to change and supervise the batteries of the CGM and insulin pump, the calibration and insertion of the CGM sensor, to count carbohydrates for announced meals control schemes, and to take additional actions if they are going to exercise or are sick. All these facts suggest that it is unreasonable to talk of fully CL systems and that it is infeasible to remove the patient from the cause-effect chain. Instead, future FTC AID systems that are aimed to appear in the market should consider the patient as a central and crucial element of the system.

As a medical device, an AID system must guarantee the patient’s safety under daily life scenarios, thus safety and failure prevention should be one of the primary concerns in the AID system design. However, it is still difficult to assess the patient’s safety under real life scenarios due to the unpredictable behavior of humans. Then, it is crucial to perform further studies regarding the patient’s point of view of an AID system. The design of such a system should consider what patients would like to have and the interaction between the patient and the system.

The AID system should constitute an ecosystem that the patient can easily incorporate into his or her life, and altogether with caregivers constitute a cyber-physical system (CPS). Although these systems are characterized by the human factor, many studies have shown that cooperation between automatic control and humans can be done.^90-93 In Nunes et al ⁹⁴ a complete taxonomy of the human roles in CPS systems is presented. This paper outlines the need for these systems to be more flexible since they are systems created by humans for humans. We therefore urge that new AID systems, intended to automatically control T1D patients, be adapted to the human factor as the only way to become truly fully automated systems.

Conclusions

AP technology has successfully reached the market and is already an available therapy option. People with T1D that will use these systems are active elements of the control scheme as they are at the same time the plant to control and operators that have to maintain the system, perform measurements and execute actions. Uncertainty and faults can appear from improper user management, which could compromise the system. Future systems must include FTC designs to cope with the HitL to offer safer and more human-oriented control systems.