Medical devicesLife sciences

Artificial pancreas

A closed-loop insulin controller on a glucose-insulin physiology model — taming post-meal spikes while never causing a hypo: the meal challenge, the hypoglycemia trap, a low-glucose-suspend safety layer, and a virtual-patient cohort.

DjiniousLabModelling & simulation

Blood glucose over a day inside the 70-180 mg/dL target band — the open loop spiking after meals while the closed loop holds the peaks down

time-in-range (hybrid + safety): 100%time-in-range (hybrid + safety)
hypoglycemic events: 0hypoglycemic events
time-in-range gain: 81% → 100%time-in-range gain
cohort patients TIR ≥ 80%: 40 / 40cohort patients TIR ≥ 80%
design notebooks: 10design notebooks
control: safety-criticalcontrol

Closed-loop control where a mistake is an emergency.

An artificial pancreas reads blood glucose and doses insulin automatically — a closed control loop on a living patient. What makes it hard isn't keeping glucose down after a meal; it's doing that without ever pushing it too low, because a hypoglycemic event isn't a missed setpoint, it's a medical emergency. This program models the physiology, builds the controller, walks straight into that safety trap, and shows the safety layer that gets out of it — then proves it across a virtual patient cohort.

A meal is a disturbance you can't reject in time.

Carbohydrate hits the bloodstream in minutes; injected insulin takes far longer to act. So a meal sends glucose spiking, and without control it climbs past 200 mg/dL and stays high for hours. The model — a Bergman minimal glucose-insulin system with a meal glucose-appearance term — reproduces that postprandial excursion exactly, and quantifies the damage: only 81% of the day inside the healthy 70-180 band, nearly a fifth of it hyperglycemic. That's the problem a closed loop is there to fix.

Open-loop blood glucose over a day spiking above the 180 mg/dL line after each meal, with the target band shaded — The uncontrolled day: three meals, three spikes past 180 mg/dL, hours spent hyperglycemic. The shaded band is the 70-180 target; basal insulin alone can't keep the meals inside it. This is the baseline every closed-loop controller has to beat.

Closed-loop glucose tracking inside the target band, the controller pulling the post-meal peaks down compared with the open loop — Closing the loop: a feedback controller doses insulin off the glucose reading and pulls the post-meal peaks down — time-in-range jumps from 81% to 94%. But look at the dips after each meal: the controller's own overshoot is starting to chase glucose toward the low end. That's the trap.

The harder you chase the highs, the closer you get to the lows.

It's tempting to turn the controller up: more aggressive insulin dosing flattens the post-meal peaks and pushes time-in-range higher still. But insulin keeps acting after glucose has already turned around, so a hot controller overshoots downward — straight into hypoglycemia. The program makes the trap explicit: chasing the last few points of time-in-range with gain alone causes hypo events. In a real device that's not a worse score, it's a 2 a.m. ambulance. The answer isn't a better gain — it's a safety layer.

Time-in-range and hypoglycemia risk both rising as controller gain increases — the safety trap — The hypoglycemia trap, quantified: as controller gain rises, time-in-range improves — and so does hypo risk, until the aggressive loop is causing dangerous lows. The two goals pull against each other, which is exactly why a glucose controller can't just be tuned for performance.

A low-glucose-suspend safety layer lifting the post-meal nadir above 70 mg/dL while keeping time-in-range high — The way out: a predictive low-glucose-suspend that cuts insulin before glucose crosses the floor, paired with a meal-announcement feedforward. It lifts the post-meal nadir from 66 to 88 mg/dL, zeroes the hypo time, and still holds 100% time-in-range — performance and safety at once, which the gain knob alone couldn't buy.

A virtual-patient cohort's time-in-range distribution, all patients high and none hypoglycemic — Does it generalize? A 40-patient virtual cohort, spread across insulin sensitivity and meal size, all run on the same hybrid controller: every patient lands at high time-in-range and not one has a hypoglycemic event. A controller that works on one patient isn't a device; one that's safe across the cohort is the start of one.

Every number is one you can re-run.

The sign-off notebook re-derives each requirement from the same physiology model the program builds.

Result

Open-loop time-in-range: 81%
Hybrid + safety TIR: 100%
Hypoglycemic events (hybrid): 0
Cohort TIR ≥ 80%: 40 / 40
Requirements verified: 6 / 6

Requirement

Open-loop time-in-range: baseline
Hybrid + safety TIR: R-03
Hypoglycemic events (hybrid): R-04 = 0
Cohort TIR ≥ 80%: R-05
Requirements verified: PASS

A teaching & controls model, not a medical device.

The patient is the Bergman minimal model — glucose, insulin action and plasma insulin — not the high-fidelity UVA/Padova simulator used for regulatory work; the cohort is a simple spread of physiological parameters, and the CGM and pump are idealized. This is a controls and safety-engineering model, explicitly not a medical device or clinical advice. It is exactly the fidelity that builds the intuition and the control logic — the meal disturbance, the hypoglycemia trap, the value of a safety layer, and cohort robustness — on reproducible numbers, before a high-fidelity simulator and a regulated development process. And it pairs with the memory-safe-Rust path: a controller where 'verified' has to mean something.