Patent Description:
The described examples provide safety constraints for a drug delivery system that provides automatic delivery of a drug based on sensor input to ensure that users do not over or under deliver medication provided automatically based on the control algorithm.

Medication delivery systems typically deliver a medication to a user based on health conditions of the user. For example, a control algorithm-based drug delivery systems can monitor a user's glucose levels, determine an appropriate level of medication, such as insulin, for the user based on the monitored medical conditions, such as glucose levels, and subsequently dispense the medication to the user. The control algorithms used in control algorithm-based drug delivery systems and other medication delivery systems generally rely on data provided by users and/or expected glucose and medication levels determined by different means, such as insulin deliveries and the provided user data. However, the provided data or expected levels may be incorrect or erroneous, which may lead to incorrect medication dosages and incorrect medication delivery schedules. Data and measurement errors may result due to many different reasons, such as user confusion (e.g., have incorrect time, input incorrect numbers, or the like), glucose sensor drift or bias (which may be due to many different factors related to the glucose sensor), errors in the medication delivery system, or the like. As a result, conventional medication delivery systems do not provide safety constraints that enable automated medication delivery systems to respond to incorrect data and measurement errors. A need therefore exists for a medication delivery system, such as an insulin management system, that includes such features as safety constraints, alerts and remedial actions. <CIT> discloses a system according to the preamble of independent claim <NUM>.

The invention is defined in independent claim <NUM> with preferred embodiments forming the subject-matter of the dependent claims. Further disclosed is a non-transitory computer readable medium embodied with programming code executable by a processor. The processor when executing the programming code is operable to perform functions, including functions to receive at regular time intervals a value of a glucose measurement via a wireless connection with a glucose monitor. The glucose measurement is performed by the glucose monitor. Future glucose values may be predicted based on prior glucose measurement values. An insulin basal delivery rate may be adjusted to be provided by a medical device based on the predicted future glucose values. Insulin may be delivered via the medical device according to the adjusted insulin basal delivery rate.

Further disclosed is a method performed by a processor coupled to a glucose monitor via a wireless connection. The method includes receiving, by the processor from the glucose monitor, a number of glucose measurement values. Each glucose measurement value of the number of glucose measurement values is received at a regular time interval over a period of time and the regular time interval is less than the period of time. A number of future glucose measurement values may be predicted using at least one of the number of received glucose measurement values. It may be determined that a subsequent glucose measurement value has not been received within a next regular time interval. In response to the determination that the subsequent glucose measurement value has not arrived, a total daily insulin-based basal delivery rate may be adjusted to be provided by a medical device based on at least one of the predicted number of future glucose measurement values. Insulin may be delivered via the medical device according to the adjusted total daily insulin-based basal delivery rate.

Further disclosed is another method in which a processor coupled to a medical device determines that the medical device has delivered more than a preset volume of insulin over a set amount of time. The preset volume of insulin is based on one or more of: a user input basal rate, a rate calculated by an artificial pancreas algorithm using an average daily delivery rate, a rate based on user weight and/or user age, a total daily insulin delivered, or a total daily basal delivered. In response to the determination, an amount of insulin to be delivered by the medical device as an adjusted basal dosage is adjusted based on a calculation using a volume of insulin delivered over the set amount of time and a total daily insulin to be delivered as calculated by an artificial pancreas algorithm.

Disclosed is a system that includes a medical device, a sensor and a management device. The medical device includes a pump, a reservoir configured to contain insulin, a processor and a transceiver, and the medical device is operable to deliver insulin in response to outputs from the processor. The sensor may include a transmitter, a processor and a cannula. The sensor is operable to measure blood glucose and output a blood glucose value. The management device may include a processor, a memory configured to store an artificial pancreas algorithm and a transceiver. The artificial pancreas algorithm is operable to determine times and dosages of insulin to be delivered to a user, the times and dosages may be calculated based on a user's sex, a user's age, a user's weight, a user's height, and/or on glucose levels provided by the sensor. The processor of the management device upon execution of the artificial pancreas algorithm is operable to determine an occurrence of a hypoglycemic event. In response to the determination of the occurrence of the hypoglycemic event, a glucose rate of change filter may be implemented for a predetermined period of time. The rate of change filter limits a rate of change in measured blood glucose values used by the artificial pancreas algorithm in the determination of a time for delivery of insulin and a dosage of the insulin being delivered. The processor instructs the medical device to deliver the determined dosage of the insulin at the determined time for delivery.

Further disclosed is another method including determining, by a processor of a medical management device in response to receipt of a glucose measurement value from a sensor, that a medical device has been delivering insulin below a fixed personalized basal rate for a period of time of insulin delivery history. A result of delivering insulin below a fixed personalized basal rate is a negative insulin on board value. The processor may determine that the negative insulin on board value is greater than three times a user's total daily insulin-based hourly basal value. In response to the negative insulin on board value being greater than a multiple of a user's total daily insulin-based hourly basal value, delivery of insulin by the medical device may be altered to deliver a total daily-based basal or a personalized volume of insulin. A notification message may be output requesting the user to acknowledge the altered delivery of insulin or a requirement for a new calibration value for use by the processor in calculating a calibrated amount of insulin for delivery.

Further disclosed is a non-transitory computer readable medium embodied with programming code executable by a processor. The processor when executing the programming code is operable to perform functions, including functions to obtain a series of glucose concentration values as measured at regular time intervals by a glucose monitor. The processor may detect a rapid rate of increase in a glucose concentration. In reaction to the detection of the rapid rate of increase in the glucose concentration, the processor may implement a response to the rapid rate of increase in the glucose concentration.

Further disclosed is another method is disclosed in which a processor coupled to a glucose sensor determines insulin delivery is not attenuating at a rate suitable to recover from a hypoglycemic event. In response to the determination, a likelihood of suspension of insulin may be increasing by either: reducing a penalty of estimated outcomes within an artificial pancreas algorithm such that a requested insulin delivery is below a user-inputted basal delivery or scaling deviations of insulin delivery that are below the user-inputted basal delivery to be proportional to the user-inputted basal delivery.

Further disclosed is a method is disclosed in which a processor coupled to a glucose sensor determines during exercise or other activity that may induce increased hypoglycemic risk that insulin delivery is not attenuating at rate suitable to maintain glucose concentrations. In response to the determination, either the control target glucose value may be increasing to a glucose value higher than the current target glucose value or the input basal delivery may be reduced to an input basal value lower than a current input basal value.

Various examples provide safety constraints for a control algorithm-based drug delivery system, also referred to as an "artificial pancreas" algorithm-based system or more generally an artificial pancreas algorithm, that provides automatic delivery of a drug based on sensor input. For example, the artificial pancreas (AP) algorithm when executed by a processor enables a system to monitor a user's glucose levels, determine an appropriate level of insulin for the user based on the monitored glucose levels (e.g., glucose concentrations or glucose measurement values) and other information, such as user-provided information, and subsequently dispense insulin to the user. In addition, the AP algorithm utilizes the monitored glucose levels and other information to generate and send a command to a medical device, such as a pump, to control, for example, deliver a bolus dose of insulin to the user, change the amount or timing of future doses, or other controllable functions. The safety constraints described herein provide safe operation of the drug delivery system during various operational scenarios including, for example, during times when the sensor input is missing or erroneous, unexpected events such as an unplanned meal. The disclosed safety constraints mitigate under-delivery or over-delivery of the drug while not overly burdening the user of the drug delivery system and without sacrificing performance of the drug delivery system.

<FIG> illustrates an example of a drug delivery system <NUM>. The drug delivery system <NUM> can include a medical device <NUM>, a sensor <NUM>, and a management device (PDM) <NUM>. In various examples, the drug delivery system <NUM> can be an automated drug delivery system. In various examples, the medical device <NUM> can be attached to the body of a user or patient and can deliver any therapeutic agent, including any drug or medicine, such as insulin or the like, to a user. For example, the medical device <NUM> can be a wearable device. For example, the medical device <NUM> can be directly coupled to a user (e.g., directly attached to a body part and/or skin of the user). For example, a surface of the medical device <NUM> can include an adhesive to facilitate attachment to a user.

The medical device <NUM> can include a number of components to facilitate automated delivery of a drug (also referred to as a therapeutic agent) to the user. The medical device <NUM> can store and provide any medication or drug to the user. In various examples, the medical device <NUM> can be an automated, wearable insulin delivery device. For example, the medical device <NUM> can include a reservoir <NUM> for storing the drug (such as insulin), a needle or cannula for delivering the drug into the body of the user, and a pump mechanism (mech. ) <NUM> or other drive mechanism for transferring the drug from the reservoir <NUM> , through the needle or cannula (not shown), into the body of the user. The medical device <NUM> can also include a power source <NUM> such as a battery for supplying power to the pump mechanism <NUM> and/or other components (such as the processor <NUM>, memory <NUM>, and the communication device <NUM>) of the medical device <NUM>. The medical device <NUM> is often referred to as a pump, or an insulin pump, in reference to the operation of expelling a drug from the reservoir <NUM> for delivery to the user. The reservoir <NUM> may be configured to store insulin, morphine, or another drug suitable for automated delivery.

The medical device <NUM> can provide the stored therapeutic agent to the user based on information provided by the sensor <NUM> and/or the management device (PDM) <NUM>. For example, the medical device <NUM> can also contain analog and/or digital circuitry that may be implemented as a processor <NUM> (or controller) for controlling the delivery of the medication. The circuitry may be used to implement the processor <NUM>, and may include discrete, specialized logic and/or components, an application-specific integrated circuit, a microcontroller or processor that executes software instructions, firmware, programming instructions (such as artificial pancreas algorithm <NUM>) stored in memory devices (such as memory <NUM>), or any combination thereof. In various examples, the processor <NUM> can be configured to cause the pump to deliver doses of the medication to a user at predetermined intervals. For example, the processor <NUM> may execute a control algorithm, such as an artificial pancreas algorithm (AP Algo) <NUM>. The size and/or timing of the doses may be programmed, for example, into an artificial pancreas algorithm <NUM> using a wired or wireless link by the user or by a third party (such as a health care provider, medical device manufacturer, or the like).

Instructions for determining the delivery of the medication to the user (e.g., the size and/or timing of any doses of the medication) can originate locally (e.g., based on programming instructions, such as an instance of the artificial pancreas algorithm <NUM>, stored in the memory <NUM> that is coupled to the medical device <NUM> used to make determinations by the medical device <NUM>) or can originate remotely and be provided to the medical device <NUM>. Remote instructions can be provided to the medical device <NUM> over a wired or wireless link by the electronic device (PDM) <NUM>, which executes the artificial pancreas algorithm <NUM>. The medical device <NUM> can execute any received instructions originating internally or from the management device <NUM> for the delivery of the medication to the user. In this way, under either scenario, the delivery of the medication to a user can be automated.

In various examples, the medical device <NUM> can communicate via a wireless link <NUM> with the management device <NUM>. The management device <NUM> can be any electronic device such as, for example, an Apple Watch®. The management device <NUM> can be a wearable wireless accessory device. The wireless links <NUM>, <NUM> and <NUM> may be any type of wireless link provided by any known wireless standard. As an example, the wireless links <NUM>, <NUM> and <NUM> may enable communications between the medical device <NUM>, the management device <NUM> and sensor <NUM> based on Bluetooth®, Wi-Fi®, a near-field communication standard, a cellular standard, or any other wireless optical or radio-frequency protocol.

The sensor <NUM> may be a glucose sensor operable to measure blood glucose and output a blood glucose value or data that is representative of a blood glucose value. For example, the sensor <NUM> may be a glucose monitor or a continuous glucose monitor (CGM). The sensor <NUM> may include a processor <NUM>, a memory <NUM>, a sensing/measuring device <NUM>, and communication device <NUM>. The communication device <NUM> of sensor <NUM> can include one or more sensing elements, an electronic transmitter, receiver, and/or transceiver for communicating with the management device <NUM> over a wireless link <NUM> or with medical device <NUM> over the wireless link <NUM>. The sensing/measuring device <NUM> may include one or more sensing elements, such as a glucose measurement, heart rate monitor, or the like. For example, the sensor <NUM> can be a continuous glucose monitor (CGM). The processor <NUM> may include discrete, specialized logic and/or components, an application-specific integrated circuit, a microcontroller or processor that executes software instructions, firmware, programming instructions stored in memory devices (such as memory <NUM>), or any combination thereof. For example, the memory <NUM> may store an instance of an AP algorithm <NUM> that is executable by the processor <NUM>. Although the sensor <NUM> is depicted as separate from the medical device <NUM>, in various examples, the sensor <NUM> and medical device <NUM> may be incorporated into the same unit. That is, in various examples, the sensor <NUM> can be a part of the medical device <NUM> and contained within the same housing of the medical device <NUM> (e.g., the sensor <NUM> can be positioned within or embedded within the medical device <NUM>). Glucose monitoring data (e.g., measured glucose values) determined by the sensor <NUM> can be provided to the medical device <NUM> and/or the management device <NUM> and can be used to adjust automated delivery of insulin by the medical device <NUM>. The management device <NUM> can be a personal diabetes manager.

The sensor <NUM> can also be coupled to the user by, for example, adhesive or the like and can provide information or data on one or more medical conditions and/or physical attributes of the user. The information or data provided by the sensor <NUM> may be used to adjust drug delivery operations of the medical device <NUM>. The management device <NUM> can be used to program or adjust operation of the medical device <NUM> and/or the sensor <NUM>. The management device <NUM> can be any portable electronic device including, for example, a dedicated controller, such as processor <NUM>, a smartphone, or a tablet. In an example, the management device (PDM) <NUM> may include a processor <NUM>, a management device memory <NUM>, and a communication device <NUM>. The management device <NUM> may contain analog and/or digital circuitry that may be implemented as a processor <NUM> (or controller) for executing processes to manage a user's glucose and for controlling the delivery of the medication. The processor <NUM> may also be operable to execute programming code stored in the management device memory <NUM>. For example, the management device memory <NUM> may be configured to store an artificial pancreas algorithm <NUM> that may be executed by the processor <NUM>. The processor <NUM> may, when executing the artificial pancreas algorithm <NUM>, be operable to perform various functions, such as those described with respect to the examples in the figures. The communication device <NUM> may be a receiver, a transmitter or a transceiver that operates according to one or more radio-frequency protocols.

The medical device <NUM> and the sensor <NUM> may communicate over a wireless link <NUM>. The medical device <NUM> and the management device <NUM> may communicate over a wireless link <NUM>. The sensor <NUM> and the management device <NUM> may communicate over a wireless link <NUM>. The wireless links <NUM>, <NUM>, and <NUM> may be any type of wireless link provided by any known wireless standard. As an example, the wireless links <NUM>, <NUM>, and <NUM> can provide communication links based on Bluetooth, Wi-Fi, a near-field communication standard, a cellular standard, or any other wireless protocol via the respective communication devices <NUM>, <NUM> and <NUM>. In some examples, the medical device <NUM> and/or the management device <NUM> may include a user interface, such a keypad, a touchscreen display, buttons, a microphone, a speaker, a display or the like, that is operable to allow a user to enter information and allow the management device to output information for presentation to the user.

In various examples, the drug delivery system <NUM> can be an insulin drug delivery system. In various examples, the medical device <NUM> can be the OmniPod® (Insulet Corporation, Billerica, MA) insulin delivery device as described in <CIT>, <CIT>, or <CIT>.

In various examples, the drug delivery system <NUM> can implement the artificial pancreas (AP) algorithm (and/or provide AP functionality) to govern or control automated delivery of insulin to a user (e.g., to maintain euglycemia - a normal level of glucose in the blood). The AP algorithm can be implemented by the medical device <NUM> and/or the sensor <NUM>. The AP algorithm can be used to determine the times and dosages of insulin delivery. In various examples, the AP algorithm can determine the times and dosages for delivery based on information known about the user, such as the user's sex, age, weight, or height, and/or on information gathered about a physical attribute or condition of the user (e.g., from the sensor <NUM>). For example, the AP algorithm may determine an appropriate delivery of insulin based on glucose level monitoring of the user through the sensor <NUM>. The AP algorithm may also allow the user to adjust insulin delivery. For example, the AP algorithm may allow the user to issue (e.g., via an input) commands to the medical device <NUM>, such as a command to deliver an insulin bolus. In some examples, different functions of the AP algorithm may be distributed among two or more of the management device <NUM>, the pump <NUM> or the sensor <NUM>. In other examples, the different functions of the AP algorithm may be performed by one device, such as the management device <NUM>, the pump <NUM> or the sensor <NUM>. In various examples, the drug delivery system <NUM> can operate according to or can include any of the features or functionalities of the drug delivery systems described in <CIT>.

As described herein, the drug delivery system <NUM> or any component thereof can be considered to provide AP functionality or to implement an AP algorithm. Accordingly, references to the AP algorithm (e.g., functionality, operations, or capabilities thereof) are made for convenience and can refer to and/or include operations and/or functionalities of the drug delivery system <NUM> or any constituent component thereof (e.g., the medical device <NUM> and/or the management device <NUM>). The drug delivery system <NUM> - for example, as an insulin delivery system implementing an AP algorithm - can be considered to be a drug delivery system or an AP algorithm-based delivery system that uses sensor inputs (e.g., data collected by the sensor <NUM>).

Since the drug delivery system <NUM> relies on sensor input for proper operation of drug delivery, the drug delivery system <NUM> may impose delivery limits for safety reasons. While delivery constraints may be imposed to ensure safe automatic delivery of a drug (e.g., insulin) to the user, it may be, in some examples, desirable to not have the constraints overly reduce AP algorithm control performance or to overly burden the user. Techniques described herein enable the drug delivery system <NUM> to maximize user safety while optimizing glucose control performance and minimizing any additional burden or inconvenience placed on the user.

The sensor <NUM> - for example, as a CGM - can operate with or otherwise exhibit sensor bias, drift, or other discrepancies of determined data values that could lead to over-delivery or under-delivery of a drug to the user. The techniques described herein provide safety constraints for operation of the drug delivery system <NUM> that include safety mitigations in case of failure of the sensor <NUM>, errant values provided by the sensor <NUM>, and/or missing data from the sensor <NUM>, as well as from other risks associated with relying on the sensor <NUM>. The techniques described herein also provide safety constraints specific to higher risk conditions such as lower glucose values and a response of the implemented AP algorithm to outside perturbations, such as rescue carbohydrates or the like.

The drug delivery system <NUM>, in some examples, may be a wearable, automated drug delivery system that includes the medical device <NUM>, the sensor <NUM>, and a management device <NUM>. In one example of a wearable, automated drug delivery system, the medical device <NUM> may be a wearable insulin delivery device, the management device <NUM> may be a handheld electronic computing device, and the sensor <NUM> may be a continuous glucose monitor. The management device <NUM> can be a mobile device or cellphone or can be a dedicated custom electronic device. As part of a wearable, automated drug delivery system, the medical device <NUM> and the sensor <NUM> may each be directly coupled to a user.

The sensor <NUM> can provide sensor data to the medical device <NUM> and/or the management device <NUM>. The management device <NUM> can include a controller or processor and a memory. The memory can store instructions that can be executed by the controller or processor. The instructions can implement an "artificial pancreas" algorithm when executed. In general, the management device <NUM> can include a controller for determining a delivery of insulin to the user (e.g., in terms of dosage amounts and times) based on data from the sensor <NUM> and providing a corresponding instruction regarding the determined delivery of the insulin to the medical device <NUM>.

In various examples, as mentioned above, the sensor <NUM> can be provided as part of or embedded within the wearable insulin delivery device <NUM>. Additionally, in various examples, as mentioned above, the system <NUM> can include an intermediate wireless device (e.g., the management device <NUM>) that can relay information wirelessly between the devices depicted in <FIG>.

In general, the system <NUM> can automatically monitor glucose levels of the user, automatically determine a delivery of insulin to the user based on the monitored glucose levels, and automatically provide the determined amount of insulin to the user. Each of these steps can be performed without any user input or interaction. In various examples, a user confirmation can be required before the insulin is provided to the user as discussed above. For example, when management device <NUM> is implemented as a cellphone, for added security, the user can be required to confirm or acknowledge the determined delivery of insulin to the user. Without receiving such confirmation, the insulin delivery may be blocked or prevented. This security feature can mitigate hacking or other cybersecurity risks.

In various examples, the drug delivery system <NUM> can operate such that glucose values are regularly provided by the sensor <NUM> to the AP algorithm executing on a processor (e.g., to the medical device <NUM> and/or the management device <NUM>). For example, glucose values can be provided periodically such as, for example, approximately every <NUM> minutes (e.g., corresponding to a control cycle of the system <NUM>) or the like. The medical device <NUM> can adjust an amount of insulin for delivery based on the received glucose values.

It may be helpful to briefly describe an operational example performed by system <NUM> with reference to <FIG>. The AP algorithm <NUM> or <NUM> of <FIG> executing on a management device processor <NUM> or medical device processor <NUM> of <FIG> may implement process <NUM> as shown in <FIG>. At <NUM>, the AP algorithm may receive at regular time intervals a glucose measurement via a wireless connection (e.g., <NUM> or <NUM>) with a glucose monitor (such as sensor <NUM>). Regular time intervals may be intervals, such as approximately every <NUM> minutes, <NUM> minutes, hourly, a particular time(s) of day, or the like. Based on the prior glucose values, the AP algorithm may predict future glucose values (<NUM>). Based on the predicted future glucose values from <NUM>, the AP algorithm may, at <NUM>, adjust insulin delivery, for example, by adjusting an insulin basal delivery rate, based on predicted future glucose values. At <NUM>, insulin may be delivered via the medical device according to the adjusted insulin basal delivery rate. For example, the medical device <NUM> can deliver an amount of insulin to the user at regular time periods, such as approximately every <NUM> minutes or the like, with the amount adjusted based on received glucose values.

The process <NUM> of the example of <FIG> may continue with the processor receiving a subsequent glucose measurement value via the wireless connection with the glucose monitor. The total daily insulin-based basal glucose level may be determined using the received subsequent glucose measurement value and the prior glucose values from a past time period. The processor may compare the total daily insulin-based basal glucose level to a user-set basal glucose setpoint (e.g., <NUM> -<NUM>/dL or the like). In response to a result of the comparison indicating the user-set basal glucose setpoint is erroneous, the processor may determine an updated insulin basal delivery rate to be delivered by the medical device. In the example, the updated insulin basal delivery rate is updated from the adjusted insulin basal delivery rate from step <NUM>.

Techniques described herein provide safety constraints for the delivery of insulin based on known or unknown failures or inaccuracies of the sensor <NUM>. Various operational scenarios and examples of response thereto by the system <NUM> are described herein.

In an operational example, the system <NUM> may react with an automatic suspension of insulin deliver when a blood glucose measurement is below a glucose threshold according to the following discussion. In the operational example, regardless of predictions made by the AP algorithm, the AP algorithm can enter an automatic suspension mode when a glucose level determined by the sensor <NUM> is below a threshold (e.g., below <NUM>/dL). The AP algorithm can automatically resume delivering insulin based on model prediction control (MPC) algorithms when glucose values rise above the threshold. In various examples, when hypoglycemia is detected (e.g., based on glucose levels being below a predetermined threshold), the drug delivery system <NUM> can stop delivery of insulin to the user. Automatically resuming delivery to the user can be provided when the glucose levels rise above the threshold. MPC algorithms - operating as part of the AP algorithm - can be used for automatic start-up.

In other operational examples, the system <NUM> may react to constrain the AP algorithm to a basal below a threshold according to the following discussion. In various examples, the AP algorithm can be constrained to deliver no more than a fixed rate of insulin when glucose values are below a predetermined threshold. <FIG> illustrates an example of constraining delivery to no more than a fixed rate of insulin under such a scenario. The AP algorithm may attenuate or suspend insulin delivery when glucose values are below the threshold. The fixed rate of insulin delivery can be personalized to the user and can be determined by the user's entered basal rate, a rate calculated by the AP algorithm-based on average AP algorithm-based daily delivery, a rate based on the user's weight, age, total daily insulin (TDI), and/or other metrics.

As an example, a "TDI-based basal" can be calculated by multiplying the user's total daily insulin requirement, or the sum of insulin deliveries of the user for a past time period, such as <NUM> hours, by <NUM> (assuming that the basal would naturally be covered by half of the user's total insulin requirements per day, while the other half of the user's total insulin requirements per day is covered by insulin provided at meal time, or as a bolus), then dividing that value by <NUM> (i.e. number of hours in a day). For instance, if the user's TDI is <NUM>, the user's TDI-based basal is <NUM>*<NUM>/<NUM>, or <NUM> U/h. This gives an estimate of the total basal the user may actually need, daily, with reduced susceptibility to any erroneously user-entered basal values.

The predetermined threshold may be a fixed (e.g., hard wired) threshold, a user set threshold, or a user set threshold adjusted by a fixed (positive or negative) deviation value (e.g., the user set target glucose less a fixed <NUM>/dL adjustment). As an example, the fixed rate of insulin delivery can be roughly half of a set basal delivery when glucose levels are below the predetermined threshold. <FIG> illustrates an example of the fixed rate of insulin delivery for a user being roughly limited to the user's TDI-based insulin.

Techniques described herein can account for sensor values provided to the AP algorithm/the drug delivery system <NUM> that may be incorrect or erroneous for any number of reasons by providing sensor independent safety constraints. In such instances, the system <NUM> may implement a glucose independent safety constraint for maximum delivery of insulin over a period of time as described below.

For example, <FIG> shows a flow chart of a process for implementing an example of a safety constraint in response to an over-delivery of insulin. In various examples, such as in process <NUM>, the AP algorithm can be constrained to a maximum fixed rate of insulin delivery if the AP algorithm has delivered more than a preset volume of insulin, personalized to the user, over a set amount of time. For example, a process is operable to upon execution of an AP algorithm to deliver a maximum amount of the user's entered basal or TDI based basal if the AP algorithm has delivered <NUM> times the sum of the user's basal delivery in the past <NUM> hours - often referred to as the 3x3 rule). The processor (such as processor <NUM>) coupled to a medical device (such as <NUM>, which may be a pump) may determine that the medical device has delivered more than a preset volume of insulin over a set amount of time (<NUM>). An amount of insulin to be delivered by the medical device as an adjusted basal dosage may be adjusted based on a calculation using a volume of insulin delivered over the set amount of time and a total daily insulin to be delivered as calculated by an artificial pancreas algorithm (<NUM>). At <NUM>, the processor may limit the amount of insulin to be delivered as the adjusted basal dosage to a maximum volume of a user's basal insulin delivery volume divided by either a time increment, at which the adjusted basal dosage is administered or a percentage of an hourly basal rate. In the example of <FIG>, the time increment may be at regular time intervals. Examples of regular time intervals may be less than an hour, such as for example, <NUM> minutes, <NUM> minutes, <NUM> minutes or the like, longer than an hour, or the like. Alternatively, the time increments may simply be increments that are based on a counter value or the like.

The AP algorithm may attenuate or suspend insulin delivery in this case but is constrained to a maximum insulin delivery. <FIG> illustrates an example of constraining maximum insulin delivery. The fixed rate of insulin delivery and the preset volume of insulin delivery can be personalized to the user and can be determined by the user's entered basal rate, a rate calculated by the AP algorithm-based on average AP algorithm-based daily delivery, a rate based on weight, age, total daily insulin delivered, total daily basal delivered, or other metrics. Additionally, the constrained delivery may be accompanied by an alert or alarm to the user indicating the same.

In other instances, the system <NUM> may implement a glucose independent safety constraint for maximum delivery of insulin at one time as described below. In various examples, the AP algorithm can be constrained to deliver no more than a fixed volume of insulin personalized to the user over any one control cycle. For example, the AP algorithm can deliver no more than <NUM> times the user's basal divided in <NUM>-minute increments (e.g., often referred to as the 6x rule), or <NUM>% of the hourly basal rate in one algorithm delivery (e.g., basal rate of <NUM> u/hr / <NUM> =. <NUM> units). The fixed volume of insulin delivery can be personalized to the user and can be determined by the user's entered basal rate, a rate calculated by the AP algorithm-based on average AP algorithm-based daily delivery, a rate based on weight, age, total daily insulin delivered, total daily basal delivered, or other metrics.

In further instances, the system <NUM> may implement a glucose independent safety constraint to limit under delivery of insulin as described below. In various examples, the AP algorithm/the drug delivery system <NUM> can implement a negative insulin on board (IOB) constraint. The AP algorithm can enter a fixed rate of insulin delivery mode personalized to the user if the AP algorithm under-delivers insulin by more than a volume of insulin personalized to the user over a period of time incorporating the IOB. For example, <NUM> times the user's basal in the past <NUM> hours, after applying an IOB decay curve. The AP algorithm calculates the remaining IOB at each control cycle. A negative IOB determination can indicate that the algorithm has been delivering below a fixed personalized rate (i.e., basal) for a period of time of insulin delivery history. The negative IOB value can be the cumulative "under basal" delivery accounting for IOB decay.

<FIG> illustrates a flow chart of a process for implementing an example of a safety constraint in response to an under-delivery of insulin. In the process <NUM>, a processor (such as <NUM> or <NUM> of <FIG>) may receive signals from a medical device indicative of an amount of insulin being delivered by the medical device (such as <NUM> of <FIG>), the processor may maintain a total amount (e.g., volume) of insulin delivered as, for example, an insulin delivery history, in a memory (such as <NUM> or <NUM> of <FIG>). The insulin delivery history may, for example, span minutes, hours, days, weeks, months, a time period between doctor appointments, years, or the like. In the example process <NUM>, a processor of a medical management device (such as <NUM> of <FIG>) may determine in response to receipt of a glucose measurement value from a sensor (such as <NUM> of <FIG>) that a medical device has been delivering insulin below a fixed personalized basal rate for a period of time of insulin delivery history (<NUM>). A result of delivering insulin below a fixed personalized basal rate is a negative insulin on board value. At <NUM>, the processor may determine that the negative insulin on board value is greater than three times a user's total daily insulin-based hourly basal value. In response to the negative insulin on board value being greater than a multiple (such as <NUM>, <NUM>, <NUM> or the like) of a user's total daily insulin-based hourly basal value, delivery of insulin by the medical device may be altered to deliver a total daily-based basal or a personalized volume of insulin (<NUM>). At <NUM>, a notification message may be output requesting the user to acknowledge the altered delivery of insulin or a requirement for a new calibration value for use by the processor in calculating a calibrated amount of insulin for delivery.

The process <NUM> may continue at <NUM> the process <NUM> determines whether a user acknowledgment of request for a new calibration value has been received. In response to receipt of user acknowledgement of the altered delivery of insulin, the medical device continues the altered delivery of insulin (<NUM>). In response to receipt of the new calibration value, the processor generates the new calibration value (<NUM>) and the new calibration value is applied by the processor to calculate the calibrated amount of insulin for delivery (<NUM>).

In various examples, if this negative IOB determination is greater than <NUM> times the user's TDI-based hourly basal value, the AP algorithm can revert to delivering the TDI-based basal or personalized volume of insulin and inform the user of the same. User input can be required via a notification message for the user to acknowledge the system state or requirement for a new calibration value. The system <NUM> can deliver basal until the notification message is acknowledged or the calibration entered. Further, the system <NUM> can resume operating in a manner prior to the negative IOB determination in response to a user acknowledgement and/or performance of a calibration of sensor <NUM>, which in this example, may be a continuous glucose monitor (CGM).

Disclosed are examples that relate to determining and resolving communication issues, such as those between any of a sensor, such as <NUM>, and a pump <NUM> and/or a management device, such as <NUM> in a drug delivery system, such as that described with reference to <FIG>.

<FIG> shows a flow chart of a process for implementing an example of a safety constraint in response to a communication issue within a drug delivery system such as the example drug delivery system shown in <FIG>. In various examples, under a scenario where measurement values from the sensor <NUM> are not being received by the AP algorithm (e.g., missing values from the sensor <NUM>), the system <NUM> may respond according to the example process <NUM> shown in <FIG>. In the example of <FIG>, the process <NUM> may be a response based on the last known value (or values) from the sensor <NUM>. For example, at <NUM>, a processor, such as <NUM>, <NUM>, or <NUM>, may receive a number of glucose measurement values from the sensor <NUM>. In the example, each glucose measurement value of the number of glucose measurement values may be received at a regular time interval over a period of time and the regular time interval is less than the period of time. Of course, the regular time intervals may be like those mentioned in the discussion of <FIG>. The processor may use at least one of the number of received glucose measurement values, at <NUM>, to predict future glucose values. For example, each time the AP algorithm executing on the processor receives a value, a future glucose value to be received at a future time interval may be predicted. The processor may determine that a subsequent glucose measurement value has not been received within a next regular time interval (<NUM>). For example, when a glucose measurement value from the sensor <NUM> is expected but not received, the system <NUM> can use the predicted glucose values generated when the last received value from the sensor <NUM> was received. For example, in response to the determination that the subsequent glucose measurement value has not arrived, a total daily insulin-based basal delivery rate may be adjusted to be provided by a medical device based on at least one of the predicted number of future glucose measurement values (<NUM>). The processor may issue instructions to the medical device, such as <NUM> of <FIG>, so insulin, at <NUM>, may be delivered via the medical device <NUM> according to the adjusted total daily insulin-based basal delivery rate.

In a further example, the insulin may be delivered via the medical device according to the adjusted total daily insulin-based basal delivery rate for a trusted prediction period of time. In the further example, the processor may further determine to suspend delivery of insulin in response to a last-received glucose measurement value being within a particular range of previous glucose measurement values and the trusted prediction period of time spanned a duration of time corresponding to a predetermined number of regular time intervals. The time period during which delivery of insulin is to be suspended may be determined based on a value of the last-received glucose measurement value falling within a particular range of a plurality of ranges of glucose measurement values. In response, a time period for suspending the delivery of insulin may be selected from a number of pre-set time periods, and the processor may suspend deliver of insulin for the selected time period.

Alternatively, the medical device may deliver the insulin using the prior predicted glucose values (and corresponding insulin dosage values) for an allowed "trusted prediction" period of time. In yet another example, the insulin delivery can continue if the last received value from the sensor <NUM> was above a threshold and is predicted to deliver above a baseline rate of insulin, and predictions can be used for <NUM> minutes or longer.

If the values from the sensor <NUM> do not resume before the trusted prediction period of time ends, then the AP algorithm response may depend on the last received value (or values) from the sensor <NUM> and the predictions based thereon by the AP algorithm. In various examples, the AP algorithm can respond with insulin delivery and possibly a notification to the user via the management device <NUM>, for example, according to the following table:.

In various examples, each cycle (e.g., control cycle) referred to above can be of any duration including, but not limited to, approximately <NUM> minutes, <NUM> minutes or the like.

In various examples, the AP algorithm may permanently or temporarily attenuate the extended portion of an extended bolus in response to glucose level alone, glucose level and AP algorithm predictions, or AP algorithm predictions alone. In various examples, the AP algorithm may automatically cancel an extended portion of an extended bolus in response to glucose levels alone, glucose levels and AP algorithm predictions, or AP algorithm predictions alone. The extended portion of the extended bolus may be applied to correction or meal IOB for future automated or manual insulin dosing decisions. If applied to correction IOB, the AP algorithm may be more conservative in low glycemia. If applied to correction IOB, the AP algorithm may be more conservative in high glycemia.

In other instances, the system <NUM> may limit the system's response to a hypoglycemic event response such as ingesting rescue carbohydrates as described below. For example, in the case where the user experiences a hypoglycemic event (e.g., glucose concentration is below a <NUM>/dL hypoglycemic threshold), the user may act by ingesting fast acting carbohydrates to quickly increase the user's blood glucose. This is an unannounced meal to the system <NUM> which has the potential to be viewed by the system <NUM> as a very rapid increase in glucose. In response, the system <NUM> may respond by delivering additional insulin to compensate for these carbohydrates. However, this may not be a preferred response as the carbohydrates were taken specifically to increase the glucose levels of the user and the user may not want to receive insulin to counteract these carbohydrates.

In an example, the processor, by executing programming code stored in a memory, may perform a function to determine, based on a measurement provided by a glucose monitor (such as sensor <NUM> of <FIG>), a hypoglycemic event has occurred. In response to the determination a hypoglycemic event has occurred, the system <NUM> via a processor, such as <NUM>, <NUM> or <NUM>, may modify the adjusted insulin basal rate. For example, the processor may modify the adjusted insulin basal rate by setting a reduced temporary basal rate of the medical device that is used for dosing calculations for a predetermined period of time following the determination of the occurrence of the hypoglycemic event. Alternatively, the system <NUM> via a processor may set a reduced temporary basal rate that may be used in dosing calculations until a glucose rate of change decreases below a predetermined threshold after the determination of the occurrence of the hypoglycemic event. In another alternative, the system <NUM> may set a reduced temporary basal rate that can be used in dosing calculations until the blood glucose (as measured by a sensor, such as <NUM> of <FIG>) is above a predetermined threshold following the determination of the occurrence of the hypoglycemic event.

For example, techniques for detecting such a scenario (e.g., the system <NUM> detecting an ingestion of fast acting carbohydrates to address a hypoglycemic event) are described herein and may include the following detection techniques: <NUM>) Detection of a rapid rate of increase in glucose concentrations beyond a certain threshold (e.g., <NUM>/dL per minute); <NUM>) Detection of a rapid rate of increase in glucose concentration across a certain series of glucose concentration values when the first value of the series is below a first threshold (e.g., detecting a rapid rate of change as in (<NUM>) when the first value of the series is below the hypoglycemic threshold of <NUM>/dL); <NUM>) Detection of a rapid rate of increase in glucose concentration when any value of the series is below a second threshold (e.g., detecting a rapid rate of change as in (<NUM>) when any value in the series is below the system target glucose of <NUM>/dL); and/or <NUM>) Detection of a rapid change in the second derivative (e.g., acceleration) of the glucose concentration higher than a predetermined threshold (e.g., finding a significant change in the rate of change of glucose concentrations across any number of points - e.g., from a glucose concentration decrease of <NUM>/dL per minute to an increase of <NUM>/dL per minute).

<FIG> is a flowchart of an example process for implementing an example of a response to a rapid rate of increase in glucose concentration, or measurements. In the example of <FIG>, a processor executing programming code, such as an AP algorithm, may perform a process <NUM>. The processor may be operable to obtain a series of glucose concentration values as measured at regular time intervals by a glucose monitor (<NUM>). The processor may detect a rapid rate of increase in a glucose concentration and may implement a response to the rapid rate of increase in the glucose concentration in reaction to the detection of the rapid rate of increase in the glucose concentration, or measurements (<NUM>).

For example, in response to detecting (using, for example, the above the detection techniques) a rapid rate of increase in glucose concentration that is indicative of the ingestion of fast acting carbohydrates to address a hypoglycemic event, a response to detection of the ingestion of fast acting carbohydrates to address a hypoglycemic event (e.g., by the system <NUM>) may be implemented (<NUM>). In an example, a processor within system <NUM>, upon executing the programming code, may be operable to perform functions when implementing a response to the rapid rate of increase in the glucose concentration such as those described below. Examples of techniques implemented by the system via the processor executing programming code may implement a response to the detection of the ingestion of fast acting carbohydrates (based on the rapid rate of increase in glucose concentration) in response to the rapid rate of increase in the glucose concentration are described below and may include one or more of the following:.

All aforementioned predetermined thresholds may be user-defined, fixed, adapted over time using AP algorithm parameters, or personalized to the user based on TDI or a TDI derivative. In addition, other responses, such as reducing a temporary basal rate that is used for dosing calculations are described in more detail with reference to other examples.

Returning to the system example of <FIG>, the management device processor <NUM> of management device <NUM> in the system <NUM> may be operable, upon execution of the programming instructions including the artificial pancreas algorithm, to perform various functions. For example, the management device processor may determine times and dosages of insulin to be delivered to a user. The times and the dosages may be calculated based on a user's sex, a user's age, a user's weight, a user's height, and/or on glucose levels provided by the sensor.

In an example, the management device processor <NUM> may determine an occurrence of a hypoglycemic event. In response to the determination of the occurrence of the hypoglycemic event, the management device processor may implement a glucose rate of change filter for a predetermined period of time. The glucose rate of change filter may limit a rate of change in measured blood glucose values used by the artificial pancreas algorithm in the determination of a time for delivery of insulin and a dosage of the insulin being delivered. The management device processor may instruct the medical device via wireless link <NUM> to deliver the determined dosage of the insulin at the determined time for delivery. The management device processor <NUM> may limit a duration of time for implementation of the glucose rate of change filter by applying one or more limitations, including: a time when a measured glucose value first went below a predetermined threshold related to the hypoglycemic event, from a time that a measured glucose value comes above another predetermined threshold after the occurrence of the hypoglycemic event, until the glucose rate of change decreases below a further predetermined threshold, or until the glucose is above an additional predetermined threshold.

The management device processor <NUM> may be further operable to apply the glucose rate of change filter at one of: at all times, when both a positive and a negative glucose rate of change are determined, or only when a positive glucose rate of change is determined.

In another example, the management device processor <NUM> upon execution of the artificial pancreas algorithm is further operable to perform one of: change from closed loop operation modes to open loop operation mode; constrain a maximum insulin delivery according to a basal delivery rate personalized for a user for a set period of time after detection or until an event is over, wherein the event is an event different from the hypoglycemic event; deliver a set personalized basal rate for a set period of time after detection or until the hypoglycemic event is over; limit the rate of change as used by the processor for a set period of time after detection or until the event is over; or the rate of change filter is applied to limit the response by the artificial pancreas algorithm at all times or following a hypoglycemic event.

In some scenarios, insulin delivery may not be attenuated as rapidly as desired (e.g., at a rate suitable to recover), for example, in case of the occurrence of, or the impending occurrence of, a hypoglycemic event. For example, the system <NUM> may attenuate insulin delivery at or below the quantity of insulin the user may receive without the system <NUM> if the user's glucose value is below a threshold or is trending to being reduced below a threshold. However, there may be a risk that the system <NUM> may not attenuate insulin delivery as rapidly as desired, leading the processor, for example, to cause the medical device to deliver insulin even when the user has an impending hypoglycemic risk. <FIG> shows a flow chart of a process example for implementing an example of a response that increases a likelihood of suspension of insulin. In the process <NUM>, for example, a processor coupled to a glucose sensor in the system <NUM> may determine insulin delivery is not attenuating at rate suitable to recover from a hypoglycemic event or an impending hypoglycemic event (<NUM>). In response, the processor may apply safety constraints to further reduce insulin.

For example, the processor may address this slower attenuation utilizing the foregoing techniques that modify the processor reaction via the AP algorithm and the described safety constraints executed by the processor. At <NUM>, the processor may address such a scenario in the following manner:.

In other examples, the system <NUM> may manage other scenarios in which insulin delivery is not being attenuated during exercise or other activity that may induce increased hypoglycemic risk using a number of techniques. For example, the system <NUM> can attenuate insulin delivery when an external disturbance to the system <NUM> such as exercise or an activity causes reduction in glucose concentrations and increase in hypoglycemic risk. The system <NUM> may automatically detect this external disturbance. Alternatively, the external disturbance may be announced or indicated to the system <NUM> by a user (e.g., through a user interface on the medical device <NUM> and/or the management device <NUM> (not shown)). <FIG> is a flow chart of a process example for implementing an example of a response that attenuates insulin delivery. In the example process <NUM>, a processor coupled to a glucose sensor in the system <NUM> may determine insulin delivery is not attenuating at rate suitable to maintain glucose concentrations (<NUM>) or mitigate a hypoglycemic event or an impending hypoglycemic event. In response, the processor may apply safety constraints to further reduce insulin. For example, the processor may alter either a control target glucose value by increasing the control target (i.e., glucose setpoint) to a glucose value higher than the current target (e.g., to <NUM>/dL or the like from a lower current target). Alternatively, the system <NUM> may reduce an input basal value to a value lower than a current input basal value (e.g., approximately <NUM>% of the user's input basal) (<NUM>). In various examples, the system <NUM> may be subject to an additional upper bound in insulin delivery (e.g., the system <NUM> may not request insulin delivery greater than approximately <NUM>% of the user's input basal). As a result of the application of the safety constraints, attenuating insulin delivery at a more rapid rate to maintain glucose concentrations (<NUM>).

In some examples, the system <NUM> may not have sufficient insulin history related to the user. In response, insulin delivery history data and glucose value history data can be used by the system <NUM> to operate effectively within a closed loop mode of operation. If there is no known insulin history when in closed loop mode, then there may be a risk that the user has IOB and the AP algorithm may deliver more insulin than necessary. Techniques herein can address such a scenario where the system <NUM> may not have sufficient historical operating data.

In various examples, if the system <NUM> does not have sufficient glucose history when starting closed loop operation, the system <NUM> may respond in one of the following ways:.

Returning to the system example of <FIG>, the management device processor <NUM> of the management device <NUM> may, upon execution of the artificial pancreas algorithm, be operable to perform additional functions.

For example, the management device processor <NUM> may determine, upon starting closed loop operation of the artificial pancreas algorithm, that sufficient glucose history is unavailable (i.e., the glucose history is insufficient) for use by the artificial pancreas algorithm. In response to the determination sufficient glucose history is unavailable, the management device processor may request the user enter into the management device an amount of insulin delivered. The request may also include a request for a time when, or an estimated elapsed time since, the insulin was delivered. In response to receiving an amount of insulin delivered, a user's insulin on board may be calculated based on the amount of insulin delivered. Optionally, if the time when the insulin was delivered or the estimated elapsed time since the insulin was delivered is provided, these respective time or elapsed time may be included in the calculation. For example, the management device processor may be operable to determine elapsed time if only the time when the insulin was delivered is provided. The management device processor may use the calculated user's insulin on board to determine utilizing a user-personalized insulin decay curve when the user's calculated insulin on board is to fall below a predetermined threshold. Alternatively, the management device processor may, in response to the determination sufficient glucose history is unavailable, either limit maximum delivery of insulin to a predetermined value for a set amount of time or request a user response to a query of whether a non-basal insulin dose was delivered within a previous duration of time.

In some examples, the AP algorithm/system setpoint changes in response to various inputs or events (e.g., exercise or eating a meal). The system <NUM> can operate to maintain a user at a specific target, or setpoint (e.g., desired glucose level). In various examples, the system <NUM> may allow the user to set or change the setpoint of the system <NUM> under certain scenarios or for certain instances. In various examples, the system <NUM> may allow the user to set or change the setpoint of the system <NUM> temporarily for a user defined amount of time, after expiration of which the system <NUM> can revert to the previous target.

In various examples, the setpoint may be defined as a profile with different setpoints being set for different time segments of the day. The target blood glucose level may change automatically at each time segment. In various examples, in the case of a setpoint change, the system <NUM> may respond abruptly to the step change and deliver too much or too little insulin. To prevent the system <NUM> from responding to the step change, the prediction by the AP algorithm can be shifted by the amount of the target change. This can prevent the prediction from being impacted by the step change in target.

In some examples, safety constraints implemented via the AP algorithm may enable the AP algorithm to respond to sensor aberrations - noise and value step changes - such as those represented in <FIG>. For example, techniques that enable the system <NUM> to effectively manage responses to aberrations of the sensor <NUM> or abrupt step changes that are non-physiological. For example, non-physiological aberrations of the sensor <NUM> may be caused by a noisy sensor <NUM> or by a physical interaction with the sensor <NUM> such as putting pressure on the sensor <NUM> or by bumping or hitting the sensor <NUM>. The system <NUM> may respond to this sudden change in value from the sensor <NUM> and errantly deliver a drug. Techniques described herein can address this undesirable response and enable such events to be detected by the system <NUM> in the following ways: A) by determining a sensor value trend only, B) by determining a sensor value trend in one direction followed by an opposite trend - detecting a sudden change in trend, C) by determining a rate of change of the sensor value, and/or D) by determining that a first derivative or other filtering may be used. In addition, or as alternative E), in some examples, data obtained from an accelerometer within the sensor, such as <NUM>, may be used in combination with the trend. For example, pressure induced sensor issues can occur at higher rates, for example, when a person is sleeping so sleep detection via the accelerometer data may also be used to enhance the detection of the incident. The accelerometer data may also be used to sense impact to the sensor or delivery unit to enhance the detection. For example, a processor may process the accelerometer data to detect the sleep or an orientation of a person when the sensor experiences a pressure induced sensor issue.

In various examples, upon detection of any of the above listed events A-E, the system <NUM> may respond in any of the following ways: AA) The AP algorithm may change modes such as changing from closed loop operation to open loop operation; BB) Constrain the system <NUM> to a maximum delivery personalized to the user (e.g., basal) for a set period of time after detection or until the event (i.e., one of listed events A-E above) is over; CC) Deliver a set personalized rate (e.g., basal rate) for a set period of time after detection or until the event is over; DD) The AP algorithm may limit the rate of change as used by the system <NUM> for a set period of time after detection or until the event is over, or EE) A rate of change filter may be implemented to limit the response by the AP algorithm at all times or following a hypoglycemic event.

Safety constraints as applied to the AP algorithm and executed by a processor in system <NUM> may control system responses to sensor calibrations, particularly when the sensor is a continuous glucose monitor. For example, under certain situations where sensor calibrations may be required, there may be a resulting step change in a sensor value. In response, the system <NUM> may deliver a drug in response to such a step change. For example, the current state of the system <NUM> upon which a prediction can be based can depend on the input sensor values at each control step. These sensor values can be dependent on user-input reference calibration values (e.g., finger-sticks), and may change significantly if there is a significant discrepancy between the sensor readings and the finger-stick values used for calibration.

These rapid changes in sensor values can introduce an artificial step-change in the glucose trajectory (e.g., a calibration jump as shown in <FIG>) that is not a true reflection of the actual trends in the glucose concentrations. Further, the existence of a significant discrepancy between finger-stick blood glucose (BG) values and CGM values at the time of calibration means that CGM values that were input to the system <NUM> prior to the calibration reference input, as well as the state estimation due to those CGM values, are less reliable and may not reflect the current state. Therefore, when these events are detected, the AP algorithm's prediction "trajectory" is reset to a flat value that matches the current, new CGM value. <FIG> illustrates an example of adjusting a prediction trajectory based on a new CGM value.

In various examples, this reinitialization may be implemented for positive and negative step changes. In various examples, this reinitialization may be limited to positive step change in the blood glucose values due to calibration only, as a negative step change in blood glucose values may induce a reduction or suspension in insulin delivery for a few cycles which may be acceptable.

For example, in system <NUM> of <FIG>, a processor, such as <NUM>, <NUM> or <NUM>, may be operable to execute a process by which the processor receives one or more glucose measurement values from the glucose monitor, such as sensor <NUM>. The processor may also receive a user-input reference calibration value. Using the one or more glucose values and the user-input reference calibration value, the processor may identify a discrepancy between the one or more glucose values from the glucose monitor and the user-input reference calibration value. Based on the identified discrepancy, the processor may modify the adjusted insulin basal delivery rate.

In some examples, prior to modifying the adjusted insulin basal delivery rate based on the identified discrepancy, the processor may calibrate the glucose monitor based on the identified discrepancy. The processor may further determine the identified discrepancy is a positive step change in an amount of insulin being delivered. A positive step change may be, for example, an increase in a delivered amount of insulin. In response to the identified discrepancy being a positive step change, the processor may obtain a current, new blood glucose measurement value from the calibrated glucose monitor. After obtaining the current new blood glucose measurement value, the processor may use the current, new blood glucose value to modify the adjusted insulin basal delivery rate based on the identified discrepancy. Alternatively, the identified discrepancy may be determined to be a negative step change, which is a decrease in a delivered amount of insulin. In response to the identified discrepancy being a negative step change, the processor may provide an instruction to suspend delivery of insulin for a predetermined amount of time prior to modifying the adjusted insulin basal delivery rate based on the identified discrepancy.

The techniques described herein for providing safety constraints for a drug delivery system (e.g., the system <NUM> or any component thereof) can be implemented in hardware, software, or any combination thereof. For example, the system <NUM> or any component thereof can be implemented in hardware, software, or any combination thereof. Software related implementations of the techniques described herein can include, but are not limited to, firmware, application specific software, or any other type of computer readable instructions that can be executed by one or more processors. Hardware related implementations of the techniques described herein can include, but are not limited to, integrated circuits (ICs), application specific ICs (ASICs), field programmable arrays (FPGAs), and/or programmable logic devices (PLDs). In some embodiments, the techniques described herein, and/or any system or constituent component described herein can be implemented with a processor executing computer readable instructions stored on one or more memory components.

Some embodiments of the disclosed device may be implemented, for example, using a storage medium, a computer-readable medium or an article of manufacture which may store an instruction or a set of instructions that, if executed by a machine (i.e., processor or microcontroller), may cause the machine to perform a method and/or operation in accordance with embodiments of the disclosure. Such a machine may include, for example, any suitable processing platform, computing platform, computing device, processing device, computing system, processing system, computer, processor, or the like, and may be implemented using any suitable combination of hardware and/or software. The computer-readable medium or article may include, for example, any suitable type of memory unit, memory device, memory article, memory medium, storage device, storage article, storage medium and/or storage unit, for example, memory (including non-transitory memory), removable or non-removable media, erasable or non-erasable media, writeable or re-writeable media, digital or analog media, hard disk, floppy disk, Compact Disk Read Only Memory (CD-ROM), Compact Disk Recordable (CD-R), Compact Disk Rewriteable (CD-RW), optical disk, magnetic media, magneto-optical media, removable memory cards or disks, various types of Digital Versatile Disk (DVD), a tape, a cassette, or the like. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, encrypted code, programming code, and the like, implemented using any suitable high-level, low-level, object-oriented, visual, compiled and/or interpreted programming language. The non-transitory computer readable medium embodied programming code may cause a processor when executing the programming code to perform functions, such as those described herein.

Claim 1:
A system (<NUM>), comprising:
a medical device (<NUM>) comprising a pump (<NUM>), a reservoir (<NUM>) configured to contain insulin, a processor (<NUM>) and a transceiver (<NUM>), wherein the medical device (<NUM>) is operable to deliver insulin in response to outputs from the processor (<NUM>);
a sensor (<NUM>) comprising a transmitter (<NUM>), a processor (<NUM>) and a cannula, the sensor (<NUM>) operable to measure blood glucose and output a blood glucose value; and
a management device (<NUM>) comprising a management device processor (<NUM>), a management device memory (<NUM>) configured to store programming instructions including an artificial pancreas algorithm (<NUM>), and a management device transceiver (<NUM>), wherein the management device processor (<NUM>) is operable upon execution of the programming instructions including the artificial pancreas algorithm (<NUM>) to determine an occurrence of a hypoglycemic event;
characterized in that,
in response to the determination of the occurrence of the hypoglycemic event, implement a glucose rate of change filter for a predetermined period of time, wherein the glucose rate of change filter limits a rate of change in measured blood glucose values used by the artificial pancreas algorithm in a determination of a time for delivery of insulin and a dosage of the insulin to be delivered; and
instruct the medical device (<NUM>) to deliver a determined dosage of the insulin at a determined time for delivery.