Available via license: CC BY 4.0
Content may be subject to copyright.
A Review of Safety and Design Requirements of the Artificial Pancreas
HELGA BLAUW ,
1,2
PATRICK KEITH-HYNES,
3,4
ROBIN KOOPS,
2
and J. HANS DEVRIES
1
1
Department of Endocrinology, Academic Medical Center, University of Amsterdam, P.O Box 22660, 1100 DD Amsterdam,
The Netherlands;
2
Inreda Diabetic BV, Goor, The Netherlands;
3
TypeZero Technologies, LLC, Charlottesville, VA, USA; and
4
Center for Diabetes Technology, University of Virginia, Charlottesville, VA, USA
(Received 19 April 2016; accepted 13 June 2016)
Associate Editor James J. Moon oversaw the review of this article.
Abstract—As clinical studies with artificial pancreas systems
for automated blood glucose control in patients with type 1
diabetes move to unsupervised real-life settings, product
development will be a focus of companies over the coming
years. Directions or requirements regarding safety in the
design of an artificial pancreas are, however, lacking. This
review aims to provide an overview and discussion of safety
and design requirements of the artificial pancreas. We
performed a structured literature search based on three
search components—type 1 diabetes, artificial pancreas, and
safety or design—and extended the discussion with our own
experiences in developing artificial pancreas systems. The
main hazards of the artificial pancreas are over- and under-
dosing of insulin and, in case of a bi-hormonal system, of
glucagon or other hormones. For each component of an
artificial pancreas and for the complete system we identified
safety issues related to these hazards and proposed control
measures. Prerequisites that enable the control algorithms to
provide safe closed-loop control are accurate and reliable
input of glucose values, assured hormone delivery and an
efficient user interface. In addition, the system configuration
has important implications for safety, as close cooperation
and data exchange between the different components is
essential.
Keywords—Diabetes, Closed loop system, Medical device
development, Risk analysis, Sensors.
ABBREVIATIONS
CTR Control-to-range
CTT Control-to-target
FDA Food and drug administration
IDE Investigational device exemption
LGS Low-glucose suspend
MARD Mean absolute relative difference
PMA Premarket approval
SMBG Self-monitored blood glucose
INTRODUCTION
For many patients with type 1 diabetes it is difficult
to maintain normal blood glucose levels with the cur-
rently available therapies, which include multiple daily
insulin injections or continuous subcutaneous insulin
infusion with or without the use of a continuous glu-
cose monitor.
6
These therapies are all patient-man-
aged; the patient has to make treatment decisions
multiple times per day to control his blood glucose and
it requires a substantial commitment from the patient
in order to reach treatment goals. Multiple factors
affect blood glucose and both excessively high and low
glucose levels have negative health effects. An artificial
pancreas can assist the patient in overcoming these
problems by taking over glucose control from the pa-
tient in certain situations or even 24 h per day.
The main components of an artificial pancreas are a
continuous glucose monitor to assess blood glucose
concentration, a set of glucose control algorithms to
calculate the amount of insulin needed, and an infusion
pump for insulin administration to lower blood glu-
cose. Figure 1shows a diagram of the artificial pan-
creas system as discussed in this review article. There is
not just one artificial pancreas, as the implementation
of these components can differ and more components
can be added to the system. Over the past decade
multiple research groups and companies have worked
to develop artificial pancreas systems, with promising
results in clinical studies.
23
At this moment, however,
there is still no artificial pancreas system available on
the market. The prototype systems that have been used
Address correspondence to Helga Blauw, Department of
Endocrinology, Academic Medical Center, University of Amster-
dam, P.O Box 22660, 1100 DD Amsterdam, The Netherlands.
Electronic mail: h.blauw@amc.uva.nl
Annals of Biomedical Engineering (2016)
DOI: 10.1007/s10439-016-1679-2
2016 The Author(s). This article is published with open access at Springerlink.com
in clinical studies are not yet suitable for daily and
independent use by patients.
As clinical studies with artificial pancreas systems
move to unsupervised real-life settings, product
development will be a focus of companies over the
coming years. A crucial aspect in the development and
approval of medical devices is patient safety. Because
the artificial pancreas aims to automate blood glucose
control, which can lead to severe health damage in case
of malfunction, its design must meet stringent safety
requirements. Beside clinical safety requirements stated
by the Food and Drug Administration (FDA),
72
there
are currently no directions or requirements regarding
safety in the design of an artificial pancreas. To pro-
mote patient safety and facilitate the development of
artificial pancreas systems for daily use, this review
aims to provide an overview and discussion of safety
and design requirements of the artificial pancreas.
METHODS
A structured literature search was performed using
PubMed after identification of the MeSH terms and
free-text terms, for search in title and abstract, relating
to the three search components: type 1 diabetes, arti-
ficial pancreas, safety or design. The search query was:
(‘‘diabetes mellitus, type 1’’[MeSH Terms] OR ‘‘type 1
diabetes’’[tiab]) AND (‘‘pancreas, artificial’’[MeSH
Terms] OR ‘‘artificial pancreas’’[tiab] OR ‘‘bionic
pancreas’’[tiab] OR ‘‘closed-loop’’[tiab]) AND (‘‘safety
management’’[MeSH Terms] OR ‘‘patient safe-
ty’’[MeSH Terms] OR ‘‘equipment safety’’[MeSH
Terms] OR ‘‘equipment failure’’[MeSH Terms] OR
‘‘risk management’’[MeSH Terms] OR ‘‘device ap-
proval’’[MeSH Terms] OR ‘‘equipment design’’
[MeSH Terms] OR safe[tiab] OR safety[tiab] OR
‘‘risk management’’[tiab] OR approval[tiab] OR ‘‘de-
vice design’’[tiab] OR failure[tiab]). The search was
performed on December 15, 2014, was updated on
April 22, 2015 and March 24, 2016 and resulted in
187 articles, of which 19 articles were excluded based
on the title and 16 on the abstract. The excluded
articles were not about the artificial pancreas for
treatment of type 1 diabetes, were not written in
English or were news articles. The remaining articles
were read to identify safety issues and design
requirements for the artificial pancreas. Subsequently,
reviews or other articles that did not add relevant
findings or recommendations compared to more re-
cent reviews, and clinical studies or in silico studies
that assessed safety but without relevant findings were
excluded (95 articles). In addition, 22 articles were
selected from reference lists of included articles or the
authors’ personal databases. The discussion of the
safety issues and design requirements was extended
with our own experiences in developing artificial
pancreas systems.
BACKGROUND
The Artificial Pancreas
The goal of an artificial pancreas is to achieve ade-
quate mean blood glucose levels and stabilize blood
glucose by limiting excursions, while limiting the
occurrence of hypoglycemia and hyperglycemia. The
adequacy of a patient’s mean blood glucose levels is
assessed with the glycated hemoglobin (HbA1c) level.
The American Diabetes Association recommends a
HbA1c level below 7% (53 mmol/mol) for adults with
type 1 diabetes, which corresponds to a mean glucose
value below 8.6 mmol/l.
1
To reach a mean glucose le-
vel below 8.6 mmol/l, intensive insulin therapy is
required. However, for most patients it is difficult to
anticipate changes in glucose, which is affected, among
other things, by insulin dosage, meals and exercise
under varying physical and environmental circum-
stances and it is not practical for patients to constantly
monitor their glucose level and react on it. Further-
more, to avoid hypoglycemia, patients typically prefer
slightly hyperglycemic glucose levels over low-normal
values,
27
especially before the night or long-term
activities. For an artificial pancreas it is possible to
continuously monitor the glucose level and adjust in-
sulin dosing, which enables glucose control toward
low-normal values 24 h per day.
FIGURE 1. Diagram of the artificial pancreas system con-
taining the three main components, optionally other sen-
sor(s), and alarms. The user is the patient who can interact
with the whole system and, if included in the system, an-
nounce meals to the control algorithms, as represented by the
dotted lines. Solid lines indicate signals and communication
between the components. Dashed lines starting from the user
represent physiologic measurements and the dashed line to
the user indicates the pump action.
BLAUW et al.
The main components—continuous glucose moni-
tor, set of control algorithms, insulin pump—are part
of each artificial pancreas system, but the degree of
automated glucose control is different. The different
systems described here are adopted from the FDA
guidance for the development of artificial pancreas
systems.
72
The first step toward fully closed-loop glu-
cose control is a Threshold or Low-Glucose Suspend
(LGS) system, which is patient-managed therapy. With
this system the basal insulin infusion is reduced or
suspended when the algorithmic blood glucose esti-
mate reaches or approaches a low glucose value in
order to prevent or reduce the severity of hypo-
glycemia.
9,48
The next step is a Control-to-Range
(CTR) system. This system not only reduces the rate of
insulin infusion in case of low glucose values, but also
may increase insulin dosing if a high glucose value is
reached or approached. Between the predetermined
low and high glucose value the insulin infusion is not
affected by the sensor glucose values.
29
Since the pa-
tient has to monitor his blood glucose, set basal insulin
rates, and give pre-meal insulin boluses, glucose con-
trol with a CTR system is still supervised by the pa-
tient. The next logical step is a fully-automated
Control-to-Target (CTT) system, which provides
closed-loop glucose control by steering the glucose
value towards a target level. With a CTT system
patients do not have to monitor their blood glucose,
but they may have to calibrate the continuous glucose
monitor. In addition, hybrid CTT systems exist which
are not fully closed-loop systems, because these sys-
tems require some input from the patient about meals.
Both CTR and CTT systems can be insulin-only or bi-
hormonal. A bi-hormonal artificial pancreas uses a
second infusion pump to administer a second hormone
such as amylin or glucagon as an additional means to
control blood glucose levels. A gradual step toward
continuous closed-loop glucose control is evening and
overnight closed-loop control at home, which may al-
ready substantially impact glucose control as the night
period can be hard to manage for patients.
42,44,52
In this review, the term artificial pancreas refers to
glucose control systems that require minimal inter-
vention by the patient. Therefore, LGS systems fall
outside the scope of this review.
Regulatory Approval
Before patients can use an artificial pancreas in daily
practice, the system has to be approved as a medical
device by the applicable regulatory authority. For
brevity, we only consider the regulatory approval in
the United States (U.S.) and the European Union
(E.U.). In the U.S. FDA approval is required and in
the E.U. a Notified Body has to provide the CE-mark.
Numerous insulin pumps and continuous glucose
monitors, and one LGS system are approved and
available on the market in the U.S. and E.U. At this
moment no CTR or CTT systems are approved
worldwide.
For the European regulation of medical devices the
artificial pancreas is classified in class IIb. Class IIa, IIb
or III require that a Notified Body assesses that the
medical device and its quality system are in conformity
with the requirements of the Medical Device Directive,
which concern safety of the patient and other persons
and the intended performance of the device. The
company is free to choose any of the around 70
Notified Bodies. All Notified Bodies are assessed by
their national Competent Authority, usually (an
agency within) the ministry of Health, to ensure that
they remain qualified for issuing the CE-mark. Once a
CE-mark is obtained for a medical device, the com-
pany can market the device in all countries of the E.U.
The FDA regulates artificial pancreas systems as
class III device systems.
72
Class III is the highest
medical device category and includes devices with high
potential risk of injury and devices that are not found
to be substantially equivalent to already marketed
devices. Class III requires that the artificial pancreas
developer submits a Premarket Approval (PMA)
application. To get FDA approval, the PMA has to
demonstrate that the artificial pancreas is safe and
effective for its intended use. Generally, this will re-
quire data from clinical studies. Before a clinical study
can be started, an Investigational Device Exemption
(IDE) needs to be approved by the FDA.
In 2012, the FDA issued a guidance document with
recommendations on the content of IDE and PMA
applications for artificial pancreas systems.
72
This
guidance document followed after the FDA appointed
the artificial pancreas as a Critical Path Opportunity in
2006. The Critical Path Initiative of the FDA aims to
transform medical product development and evalua-
tion in the U.S. in order to facilitate pre-market ap-
proval and promote innovation. The need for such
transformation is illustrated by the approval of a LGS
system: the FDA approved this system in 2013,
whereas CE-mark was already obtained in 2009.
65
Although the FDA guidance contains valuable infor-
mation on how to demonstrate safety—especially on
documentation and clinical evaluation—it does not
cover design issues important for the safety of artificial
pancreas systems.
Risk Management
Risk management is part of both the CE-marking
and FDA approval process to ensure and demonstrate
that the design of an artificial pancreas is safe. Risk
Safety and Design Requirements of the Artificial Pancreas
management is also required for the production pro-
cess and clinical studies. The international standard for
risk management of medical devices is ISO 14971. This
standard provides a framework to identify hazards
associated with the medical device, estimate and eval-
uate the risks associated with these hazards, control
these risks, and monitor the effectiveness of that con-
trol. Together with the user requirements, the risk
management should form the basis of the design of an
artificial pancreas and it has to be kept up to date
during the whole product lifecycle to ensure safety for
the patient.
Since the artificial pancreas is a combination of dif-
ferent components, potential hazards will depend on
these components. For the artificial pancreas system as
a whole, the main hazards are over- and under-dosing of
insulin and also of glucagon or other hormones in case
of a bi-hormonal system. These hazards may cause
severe hypoglycemia, severe hyperglycemia or diabetic
ketoacidosis. The clinical requirements for safety are
that the incidence of these events should not be
increased by the artificial pancreas.
18,72
Because of the
combination of different components and glucose
control algorithms within an artificial pancreas it may
be difficult to assess safety of the composite system
without significant clinical testing. Some of the
particular risks known to be related to insulin pumps
and continuous glucose monitors may be decreased,
but also new safety issues related to network effects
may emerge.
57,65
In silico simulation of the operation
of the entire device network may be useful in uncovering
potential safety issues and speeding regulatory
approval.
16,21
Furthermore, an artificial pancreas is
intended to be used by patients in daily life and not by
health care professionals in a predictable environment.
Therefore, user-related risks should be carefully evalu-
ated and controlled. The safety issues and control
measures described in this article, and summarized in
Tables 1and 2, should be considered in the risk man-
agement of an artificial pancreas.
SAFETY OF THE ARTIFICIAL PANCREAS
COMPONENTS
Continuous Glucose Monitor
Accurate glucose measurements are essential for the
safety and efficacy of the artificial pancreas. Since
regular glucose input is needed for the control algo-
rithms, a continuous glucose monitor has to be part of
the artificial pancreas system. Although a variety of
new technologies such as implantable glucose sensors
are under development, at this moment only subcuta-
neous enzyme glucose sensors with a coupled trans-
mitter for wireless data transmission are practical for
this purpose. These sensors generate a current pro-
portional to the local glucose concentration and
through a calibration procedure this current is con-
verted into an estimated blood glucose value. Although
currently not approved as a blood glucose reference for
insulin dosing, the accuracy and reliability of enzyme
glucose sensors continues to improve.
58,69
Large posi-
tive sensor deviations from the true glucose value in-
crease the risk of hypoglycemia, whereas sensor under
readings increase the risk of hyperglycemia, because of
inappropriate insulin delivery.
8,70
In addition, gluca-
gon was less effective in the prevention of hypo-
glycemia when delivery was delayed because of positive
sensor deviations in a bi-hormonal artificial pancreas
study.
13
It is important to note that continuous glucose
monitors produce a time series rather than a sequence
of independent measurements. Although glucose sen-
sor accuracy is often evaluated using the mean abso-
lute relative difference (MARD) between sensor
glucose values and paired reference glucose values,
researchers have pointed out that MARD analysis
underestimates the amount of useful information
available within glucose sensor data. A recent assess-
ment indicates that an MARD of <10% should be
sufficient to use continuous glucose monitor values as a
reference for manual insulin dosing.
40
Recent head-to-
head comparison studies of currently available con-
tinuous glucose monitors found overall MARDs (SD)
of 12.2 (12.0)% and 19.9 (20.5)% at home,
43
and of
12.3 (12.1)%, 10.8 (9.9)%, and 17.9 (15.8)% in an
artificial pancreas study.
20
Although absolute relative
differences around 12% are acceptable for closed-loop
glucose control, the occurrence of large errors is
problematic for safe glucose control.
46,76,77
Further-
more, the accuracy of enzyme glucose sensors is less
during hypoglycemia compared to eu- and hyper-
glycemia.
43,46
Several factors contribute to sensor inaccuracy, of
which the most known factors are discussed here. The
first factor is calibration error. Calibration of the glu-
cose sensor is negatively affected by incorrect estima-
tion of the background current of a sensor, by the use
of an inaccurate reference glucose measurement or if
calibration takes place during low, high or rapidly
changing glucose values.
15
A second factor is sensor
delay, which is partly physiologic and partly inherent
to the sensor itself and data processing.
15
Thirdly, both
slow and transient sensor drift can lead to sensor
inaccuracy.
8
Biofouling may reduce sensor output over
time, whereas acute inflammation affects the accuracy
during the hours after insertion of the sensor.
15
Pres-
sure-induced sensor attenuation may reduce sensor
BLAUW et al.
readings for 15–30 min, which mainly occurs
overnight.
8
As stated, the accuracy of currently available con-
tinuous glucose monitors differs and which sources of
sensor error can be mitigated to increase accuracy and
reduce the incidence of large errors will also be dif-
ferent. In general, we recommend that the overall
MARD should be 15% or less with the sensors cali-
brated with self-monitored blood glucose (SMBG)
values.
34
Glucose sensor performance has to be
assessed both in the clinical research center and at
home using standardized procedures and multiple
analysis methods.
43
Evaluation of these results should
result in identification of situations in which the
accuracy is reduced and list the incidence of moderate
(absolute relative difference ‡20%) and large (absolute
relative difference ‡40%) sensor inaccuracies. Impli-
cations of these findings for safety of the glucose
control have to be described together with appropriate
measures to mitigate these risks.
Our personal recommendations for measures to re-
duce inaccuracies due to calibration error are: (1) base
the decision to calibrate on the difference between a
reference SMBG and the glucose sensor value and not
on a predefined time period and (2) only allow cali-
bration in case of euglycemia and stable glucose values
or at least warn the user of the risk of a calibration
error. The first measure is recommended because
SMBGs have their own inaccuracy, both device and
user related, that negatively influences sensor accu-
racy.
34,65,72
Calibration of an acceptable accurate sen-
sor with a SMBG may lead to a decrease of sensor
accuracy. Therefore, if a SMBG and sensor value are
within each other’s accepted error margins, recalibra-
tion should not be performed. If the SMBG and sensor
value deviate from each other, it is necessary to take a
second or even a third SMBG to reduce the probability
that an erroneous SMBG is being used for calibration.
The artificial pancreas software should be able to
determine if one of the three performed SMBGs is an
outlier and thus should not be used for calibration. In
addition, the artificial pancreas should inform the pa-
tient when such a reference SMBG to assess agreement
of the glucose sensor has to be performed, for example
if a predetermined period (up to 24 h) after the last
SMBG has passed and the glucose values are in the
normal range and stable, or if two glucose sensors
deviate from each other. Arguments to include two (or
more) glucose sensors in the artificial pancreas system
are discussed in the next paragraph. The second mea-
sure reduces the inaccuracy due to uncertain estimates
of background current and sensor delay. These esti-
mates should be based on careful evaluation of study
results and be included in the calibration algorithm.
Both artificial pancreas systems with one glucose
sensor
30,35,47,52,61,64
and systems with two glucose
sensors
36,50,54,74
have been used in clinical studies. At
this stage, there is no agreement on whether or not a
second sensor is necessary for safety, or whether it is
impractical to include a second sensor in the system.
One reason to include a second sensor is that unno-
ticed inaccurate sensor readings may affect glucose
control during a substantial period, as SMBGs may
only be performed every 12 h (or even up to 48 h); this
particularly affects the risk of hypoglycemia.
34,46,65
Averaging multiple sensors can improve accuracy and
especially reduce large sensor errors, but may also pose
the risk of including inaccurate sensor readings in the
blood glucose estimate.
14,76
Also other (additional)
strategies are possible to improve accuracy, such as
selection of the most accurate sensor
15
and continuous
detection of sensor deviations.
32,54
Secondly, if a sen-
sor that is run out or has failed is replaced it takes
hours before the measurements of the new sensor are
stable and reasonably accurate,
15
in our experience
even over 12 h. During these warm-up hours auto-
mated glucose control would not be possible if only
one sensor is used, which affects safety. Thirdly, a
second sensor provides a back-up in case of loss of
communication with the other sensor. Communication
aspects of the artificial pancreas system are discussed in
‘‘Combining the Components’’ section.
Apart from the mentioned measures, sensor accu-
racy can be improved with different software measures
and a combination of measures will be required to
address known factors that contribute to inaccuracy.
28
In any case, an artificial pancreas should contain
measures that enable detection of sensor inaccuracies
and failure.
8,18
Alarms should be given to the patient
to check the glucose sensor in case of inaccuracies or
the connection in case of lost communication, and to
promptly replace the sensor if it fails. Persistent (more
than 10–20 min) loss of sensor glucose values should
result in safe transition to a fallback therapy, e.g. re-
turn to patient specific insulin basal rates.
8,53
Other Sensors
Beside continuous glucose monitoring, other sen-
sors (e.g. heart rate or skin impedance sensors) can be
included in the artificial pancreas system with the aim
to measure physiological parameters that (indirectly)
affect or reflect glucose control.
73
In a review about
physiological input for artificial pancreas system,
Kudva et al. suggest to systematically determine effi-
cacy and safety of including the various possible
physiological parameters into glucose control algo-
rithms.
45
For the physiological parameters that can be
Safety and Design Requirements of the Artificial Pancreas
directly or indirectly measured with a sensor, not only
safety of the adaptation of the control algorithms is
important, but also safety issues regarding the mea-
surement method itself have to be considered. Just as
for the glucose sensor, accuracy is the main issue be-
cause this may lead to over or under correction of
hormone delivery. Accuracy requirements will depend
on how much influence the measured parameter can
have on the control algorithms. The availability of the
measurement, which may be affected by communica-
tion between devices or compliance of the patient, also
needs to be assessed. It needs to be demonstrated that
in cases where the measurement is not available, but
the targeted physiological phenomenon does occur,
closed-loop glucose control is still safe.
Besides meals, exercise is considered to be the main
challenging perturbation of glucose control in daily
life.
8,70
The influence of exercise on blood glucose de-
pends on multiple factors related to the patient, the
exercise and the environment and is therefore difficult
to include in closed-loop glucose control.
19,45
Unan-
nounced exercise was related to hypoglycemia in a
clinical trial in twelve adolescents using closed-loop
basal insulin delivery
24
and an in silico trial with 100
virtual patients receiving basal insulin infusion.
67
The
authors from both studies indicate that exercise
announcement well before exercise will be needed to
reduce the insulin delivery in time to prevent exercise-
related hypoglycemia, because of the delayed action of
subcutaneously infused insulin. Safety concerns of
manual announcements to the artificial pancreas in-
clude compliance and the difficulty of knowing whe-
ther the patient actually did what he announced.
Including a sensor to measure exercise will not enable
reducing insulin infusion before exercise, but it can be
used to reduce insulin infusion during and also after
exercise, as exercise also influences glucose concentra-
tions several hours after exercise.
22,45
Especially for
exercise performed before the evening this may be an
additional measure to reduce the risk of hypo-
glycemia.
51
Sensors that are being investigated to
measure exercise for closed-loop glucose control in-
clude accelerometers, heart rate and temperature sen-
sors. In general, a sensor to measure exercise should
only be included into an artificial pancreas if it reduces
the risk of hypoglycemia.
19
Glucose Control Algorithms
The brain of the artificial pancreas consists of the
algorithms that control the patient’s blood glucose
concentration. This set of algorithms has to take over
the glucose management from the patient and is the
truly innovative component of the artificial pancreas.
Therefore, research groups around the world have
been focusing on the development of effective and safe
glucose control algorithms. Many different control
algorithms have been designed and evaluated, most of
them being model predictive control, proportional-in-
tegral-derivative control, or fuzzy logic control.
23
Evaluation of control algorithms is now successfully
moving from supervised clinical research centers, and
supervised out-of-hospital settings to unsupervised
overnight use.
70
Effective and safe automated glucose
control during uncontrolled real-life situations, includ-
ing irregular food intake, alcohol, stress, exercise and
all kinds of spontaneous activities, will be the next step
and challenge for the control algorithms.
The delayed action of subcutaneously infused in-
sulin is the main difficulty for glucose control algo-
rithms. Pharmacodynamic action of rapid-acting
insulin peaks roughly around 90 min and action may
persist up to 8 h. Insulin pharmacokinetics was found
to have substantial variability between patients.
7
Fur-
thermore, the insulin sensitivity of a patient may vary
due to several factors, which act on different time
scales (from hours to years).
33,45,68,75
Another aspect
that has to be considered when designing control
algorithms is the inaccuracy of the continuous glucose
monitor, especially at lower and rapid changing blood
glucose values.
Irrespective of the type of control, algorithms have
to be developed using design requirements tailored to
the target population, its environment and treatment
goals.
23
At this moment, it is not possible to design
algorithms that include all relevant situations and
parameters that influence or are influenced by glucose
concentration, insulin, and glucagon sensitivity.
45
Therefore, glucose control algorithms have to be
responsive to changes in glucose trends and compen-
sate for short term (timescale of hours) changes in in-
sulin sensitivity at all times. The time interval at which
the control algorithms determine the output should
normally be on the order of 15 min, with each
incoming glucose measurement being used to update
the system estimate. Individualization of the control
algorithms is needed to account for insulin sensitivity,
but probably also for glucagon.
45
Strategies to estimate
insulin sensitivity include amongst others patient’s
weight or total daily insulin need based on current
treatment, which may be corrected for high HbA1c
levels.
56,76
Individualization also implies that auto-
matic adaptation of the individual parameter(s) is
required during the course of closed-loop treatment
with a time scale of days. Non-automatic adaptation
introduces a risk of over- or under-dosing, since
patients or health care providers may not (in time)
notice the need for adaptation. Automatic adaptation
can differ from relatively simple to advanced methods,
but should consider the occurrence of hypo- and
BLAUW et al.
hyper-glycemic events since these are the precursors of
severe adverse events.
8
Glucose swings typically result
from over-dosing and are one sign of insufficient
adaptation of the control algorithms to the patient.
79
In addition, glucose control algorithms should con-
tain multiple specific measures to further mitigate the
risk of hypoglycemia.
11,23
Options are to calculate the
insulin-on-board to explicitly take the delayed action of
insulin into account, to use algorithms that predict
hypoglycemia and consequently reduce or stop insulin
infusion, or to use pre-programmed basal insulin rates as
the starting point for insulin delivery and only cautiously
increase these if glucose values increase.
23,56,62,77
These
measures are, however, not expected to be able to pre-
vent hypoglycemia in all daily life situations, because of
the prolonged action of insulin and only one-way con-
trol is possible with insulin.
34,63,76
To further mimic
physiologic glucose control and mitigate the risk of
hypoglycemia, the use of glucagon may become an
important safety measure,
4,63,76
especially for fully
automated systems for day and night closed-loop glu-
cose control. For successful glucagon action, the insulin-
on-board should be taken into account, as high insulin
levels at the time of glucagon delivery limits the effect of
glucagon.
3,13
Moreover, it should not be possible that
control algorithms deliver both insulin and glucagon at
the same time.
78
Before glucagon can be widely used in
the artificial pancreas, a glucagon formulation that is
stable for at least a week should become available on the
market and the effectiveness of repeated glucagon
administration has to be assessed.
76
In a recently pub-
lished study, Castle et al. demonstrated in eight adults
with type 1 diabetes that glycogen stores and the
hyperglycemic response were maintained after repeated
glucagon administration.
12
At last, alarms should be
given to recommend the patient to take carbohydrates in
case hypoglycemia does occur.
23
Furthermore, glucose control algorithms can de-
pend on manual announcements to indicate certain
events. Meal announcements are often part of control
algorithms, because this enables the delivery of an in-
sulin bolus to minimize postprandial hyperglycemia.
Although on average such systems resulted in higher
amount of time in range compared to systems without
meal announcement, these are not fully automated
closed-loop systems and human errors can affect sys-
tem safety.
23
Potential errors include forgetting
announcements and incorrect carbohydrate estimation
which is quite common due to its difficulty,
7
as well as
different food intake than was announced. The asso-
ciated risks have to be assessed for each system, as
these will depend on the specific meal announcement
strategy.
17,25,26,30
These strategies vary from carbohy-
drate counting
61
to a qualitative announcement of the
size and type of meal, e.g. ‘‘typical’’ and ‘‘dinner’’.
64
Some final general requirements can be given for
control algorithms. It should be possible to safely stop
the glucose control for at least 15 min, for example for
personal care and maintenance operations, such as
replacing a glucose sensor or insulin cartridge. In case
of maintenance operations, the glucose control should
automatically stop and either automatically restart or
prompt the patient to manually restart. In addition, it
must be very clear for the patient whether the auto-
mated glucose control is functioning or not.
8
If a pa-
tient has to take over the glucose control in case of
failure of one or more components, he must be able to
see the insulin (and glucagon) delivery history. Fur-
thermore, control algorithms should be able to handle
a few missing sensor glucose values, as this is likely to
occur, but should not determine control actions if no
glucose values are available for more than a certain
amount of time which will be dependent upon the
control algorithm (typically 10–20 min). If no control
actions can be determined by the control algorithms
this should result in safe transition to a fallback ther-
apy and alarms should warn the patient.
8
Infusion Pump
The infusion pump delivers the amount of insulin (or
glucagon) prescribed by the control algorithms. To en-
able adequate glucose control with an artificial pancreas,
this hormone delivery has to be accurate and reliable. At
this moment, infusion pumps for subcutaneous insulin
administration are used in artificial pancreas systems.
Two subtypes are available: the traditional insulin pump
that uses an infusion set with relatively long tubing and
the patch pump that is directly adhered to the skin and
includes a very short (not visible) infusion set. The tra-
ditional pumps can suffer from tubing issues, whereas
patch pumps can have problems with adherence and the
separate controller.
2
Compared to the previous de-
scribed artificial pancreas components, little can be
found about safety issues for infusion pumps in artificial
pancreas systems. We did not find issues with the accu-
racy of insulin delivery for the artificial pancreas, but
issues with infusion set failures and the delivery site are
common in insulin pump therapy.
31
Infusion set kinking,
occlusion, leakage or dislocation may result in under-
delivery of insulin or glucagon. Furthermore, local tissue
alterations, such as lipohypertrophy, edema, and fibrosis
may further delay insulin action.
45
As problems with the
hormone delivery can have serious consequences for a
patient using an artificial pancreas, subcutaneous infu-
sion needs to become more reliable through better
understanding of the physiological processes and devel-
oping improved infusion sets.
31,53
At least the following two measures should be in-
cluded in artificial pancreas systems to ensure safety
Safety and Design Requirements of the Artificial Pancreas
with current infusion sets. First, to prevent clotting in
the tube or catheter, a small ‘maintenance’ bolus
should be given if no dose was given for a long period
through that infusion set.
32
Second, timely detection of
delivery failures is very important as these may stay
unnoticed by the patient for a substantial period of
time.
18,65
The software should be able to detect both
obstructed delivery (by using feedback from the pump)
and delivery without the expected effect on glucose
concentration due to e.g. leakage, dislocation or local
tissue alterations (based on control actions and feed-
back from glucose sensors). In case of such event the
patient should be warned and instructed to take
appropriate actions. Good fixation of the infusion
set(s) is important, which can be facilitated by rec-
ommending appropriate infusion sets and instruction
of the patient.
Additional safety measures should be included that
prevent over-dosing due to various software or hard-
ware failures. Feedback from the pump should be
obtained when the delivery is finished indicating the
status of the delivery and how many units have actu-
ally been delivered. If this response is not received in
time, based on the calculated time that it should take,
the system must determine the status of the insulin
delivery by querying the pump, otherwise the insulin-
on-board cannot be correctly calculated. If the soft-
ware is unable to reliably communicate with the pump
then closed-loop control must cease and the system
must revert to a safe mode of operation. A top safety
layer should examine all insulin requests and
block or reduce requests that the algorithm deems
unsafe. Furthermore, maximum insulin (and glucagon)
amounts that may be given per specific time periods
should be defined based on the individual settings of
the control algorithms.
30,72
In case such a maximum
amount has been delivered by the pump, the current
dosing should be stopped.
For bi-hormonal artificial pancreas systems, safety
measures have to be taken that prevent switching of
insulin and glucagon and thus delivery of the wrong
hormone. Separate pumps for insulin and glucagon
delivery have to be included in the system. These
pumps should have separate drivers to reduce the
chance of activating the wrong pump. Importantly, it
should be impossible to place an insulin cartridge in
the glucagon pump or vice versa by the design of the
pump chambers. In addition, the connection between
the cartridge and infusion set should be different for
insulin and glucagon, for example by using Luer-lock
and a proprietary connection. An extra measure is that
the infusion sets for insulin and glucagon are distin-
guishable by color, marks or text. In that case the
patient has additional visual information about which
infusion set is for which hormone, which is especially
useful for lengthy tubes, to assure for example that
during flushing the right tube will be disconnected
from the cannula.
Finally, the use of pre-filled insulin (and glucagon)
cartridges is preferred. Compared to cartridges that
have to be filled by the patient, this requires less human
interaction which reduces the risk of errors.
SAFETY OF THE ARTIFICIAL PANCREAS
SYSTEM
Combining the Components
The different components of an artificial pancreas
have to be combined to form one system. Close
cooperation and data exchange between these com-
ponents are essential.
72
If one of the main components
or its communication is not working properly, the
whole system is affected and the automated glucose
control will be comprised or interrupted, which
increases the risk of over- or under-dosing. To date,
wearable artificial pancreas systems used in clinical
studies are typically composed of commercially avail-
able continuous glucose monitors, insulin pumps and
consumer electronics devices, such as a smartphone or
tablet, that serve as the platform on which the control
algorithms run. This platform also enables communi-
cation between the devices and acts as the interface
between the system and the user. These separate de-
vices used to construct an artificial pancreas system are
as of yet not approved for this particular application.
Combining components from different diabetes tech-
nology companies is a challenging task as proprietary
data and communication protocols are common.
59
The
reliability and security of wireless communication
between the components and the accompanying power
consumption are considered to be weak points of these
artificial pancreas systems and should be solved to
increase the safety for use in daily life.
23,41,69,71
Fur-
thermore, using consumer electronics and its operating
system as a medical device like the artificial pancreas
raises regulatory questions about safety and reliability,
for example about interference of other applications or
operating system updates.
58
The type of configuration chosen has a significant
effect upon performance and capabilities of the system.
Various groups have pursued different system design
philosophies. One approach is to attempt to minimize
the risk of system failures by integrating the different
components of the artificial pancreas system.
10,49
Fewer separate devices may reduce failures of com-
munication, high power consumption due to wireless
communication, unauthorized remote control or access
to software, and use or storage of invalid data.
57
Other
groups have chosen a modular approach to system
BLAUW et al.
TABLE 1. Safety of the artificial pancreas components.
Component Safety aspects Mitigation measures
Continuous glucose monitor Inaccuracies, especially during hypoglycemia MARD <15%
Moderate (ARD ‡20%) and large (ARD ‡40%) measurement
errors
Identify situations with reduced accuracy and take appropriate measures, e.g. sensor
redundancy, software measures
Inaccurate reference glucose for calibration Calibration only in case of difference between SMBG and sensor;
Use of multiple SMBG values
Sensor delay and background current Calibration only during stable euglycemia
Sensor drift Detection of glucose sensor inaccuracies and failure;
Recalibration
Sensor unavailability due to loss of communication or sensor
replacement
Sensor redundancy
Other sensors Incorrect adaptation of the control algorithms Systematically determine efficacy and safety of including physiological parameters
into control algorithms
Inaccuracy Accuracy requirements depend on influence on glucose control algorithms
Sensor unavailability due to loss of communication or non-
compliance of the patient
Demonstrate that unavailability does not comprise safety
Glucose control algorithms Uncontrolled real-life situations Design requirements tailored to target population, environment and treatment target;
Responsive to changes in glucose trends
Delayed action of s.c. infused insulin Specific measures aimed at hypoglycemia risk, e.g. insulin-on-board calculation, use
of glucagon
Variability PK/insulin sensitivity between/within patients Compensate for short term changes in insulin sensitivity;
Individualization and automatic adaptation
Missing or incorrect manual announcements Assessment of risks and measures depend on specific announcement strategies
Missing glucose values System should be able to handle a few missing glucose values;
Safe transition to fallback therapy if system fails
Infusion pump Infusion set kinking or occlusion Give maintenance boluses;
Detection of obstructed delivery
Infusion set leakage or dislocation Good fixation of infusion set;
Detection of delivery without the expected effect on glucose
Software or hardware failures Guard and prevent overdosing, e.g. use feedback of pump, top safety layer, set
maximum doses
Bihormonal system: switching of insulin and glucagon Use of separate pumps, different cartridges and infusion set connections
Human errors with filling cartridges Use of pre-filled cartridges
(M)ARD (mean) absolute relative difference, CGM continuous glucose monitor, PK pharmacokinetics.
Safety and Design Requirements of the Artificial Pancreas
design, which allows the various wirelessly connected
components a degree of autonomy operation which is
designed to support ‘‘graceful degradation’’ of the
system in the event that one or more components or
system links fail.
38
For each separate device using
wireless communication the advantages and disadvan-
tages regarding functionality and safety should be
evaluated to determine if the risks are acceptable.
Furthermore, communication directions and fre-
quency, and data and system security measures should
be carefully assessed. Recently, the Diabetes Technol-
ogy Society released the Cybersecurity Standard for
Connected Diabetes Devices, which aims to provide a
framework for specifying the security requirements for
these devices and how to independently assure that
these are met.
39
The main requirements consider cryp-
tography, secure and authorized communication with
devices, and integrity protection of software and data.
An important issue in this discussion is the com-
munication with the glucose sensor(s), as this will likely
be wireless using a radio transmitter. The transmitted
radio waves do not travel well through water and thus
communication can get lost if the body is between the
transmitter and receiver. For the artificial pancreas
that depends on glucose sensor values during all kind
of activities and with different device wear positions,
we believe this issue is an important safety constraint
which has not yet received sufficient attention in
research. The communication losses reported for
studies under well controlled circumstances give an
indication of the extent of this issue.
54,55
The associ-
ated risks and possible mitigation measures will have
to be carefully investigated in clinical studies per-
formed under controlled and uncontrolled real-life
situations. It may turn out that wired communication
(e.g. in combination with the infusion set) or improved
wireless communication techniques are indicated.
The device(s) must be designed to have as low power
consumption as possible. Battery life should ideally
last several days to minimize battery change or charge,
although for some systems overnight charging may be
possible indicating that battery life of 18–24 h may be
sufficient. If chargeable batteries are used, charging
should be possible with a widely available connector
and adaptor as people may forget to bring their
charger. The same applies to replaceable batteries,
these should be widely available. A second power
consideration is that it has to be assured that simul-
taneous activation of multiple electronic components
that use high power does not lead to tasks not being
performed or a device shut down. This might for
example be the case for wireless communication to-
gether with an active pump. Thirdly, data and settings
essential for correct functioning of the control algo-
rithms should be stored in a memory that is not af-
fected by empty or changing batteries (non-volatile
memory).
Dedicated operating system and software, devel-
oped and tested according to the standard IEC 62304,
are typically used to ensure stable and safe functioning
of each device. However, the FDA has recently indi-
cated a willingness to consider permitting the use of
consumer software such as operating systems for mo-
bile devices such as smartphones. The potential safety
issues, e.g. difficulties with software upgrades, of using
such a solution will need to be carefully evaluated.
Modular software design is recommended as it enables
flexibility and facilitates testing and obtaining regula-
tory approval.
56
Redundancy of essential elements is a
known strategy to increase safety in other processes or
systems.
8
As discussed, this can be applied to the glu-
cose monitoring, but another essential element is the
processor. If the processor fails or becomes corrupted,
this can be detected with a second ‘safety processor’
that checks or guards essential functions performed by
the main processor. This safety processor should acti-
vate a safety mode in which the pumps are immediately
stopped and the patient is warned with alarms.
Moreover, the two processors should preferably be
from different manufacturers, to reduce the chance of
mutual software or hardware errors.
Alarms
Alarms are a mitigation measure for faults that are
detected by the system but that cannot be solved by the
system on its own. Alarms provided by the artificial
pancreas or the accompanying remote monitoring
application may warn the patient, her relatives,
important others or health care providers. The risk
reduction due to alarms depends on the effectiveness of
the fault detection, how the alarm is given and the
reaction of the warned person. A safety issue raised by
the alarms itself is that if too many alarms occur,
including less important and false alarms, the alarms
may be ignored or incorrect action may be taken in
response to the alarm.
8
To enhance safety provided by alarms, the system
should contain only a restricted number of alarms,
which are the important alarms that require action
from the patient. As the artificial pancreas provides
automated glucose control, low and high glucose val-
ues that can be solved by the system itself should not
lead to alarms. In addition, multiple ways of giving an
alarm should be included in the system, such as sound,
speech, vibration and visual information, and it should
be evaluated if each alarm is adequately noticed and
understood by the user. Alarms given to others by a
remote monitoring application should ideally not be
part of the risk mitigation measures of the artificial
BLAUW et al.
pancreas; safety should not rely on other devices (in-
cluding delays or failures in data transmission) and
people beside the artificial pancreas and its user.
53,60
However, remote monitoring can be a valuable tool for
safety in clinical trials and to gain knowledge about the
treatment and device functioning, for example for
parents and health care professionals, but also for
device development or quality control.
58
User Aspects
The patient will have to use the artificial pancreas
every day and it is therefore emphasized that user
acceptance and interaction play an important role in the
design of safe devices for diabetes treatment.
72,57,60,66
Although glucose control will be automated with an
artificial pancreas, the patient has to perform daily
maintenance to enable the system to function properly.
There will be frequent interaction between the patient
and the system, because of the need for SMBG input,
sufficiently charged batteries and changes of infusion
sets, cartridges and glucose sensors, and to react on
alarms. Experienced technical difficulties and inter-
ruptions in daily living are considered to be a concern
for the acceptance of artificial pancreas systems.
5
Several measures can be taken to improve the ease of
use and acceptance of the system. This will reduce user
errors and facilitate truly continuous use by the
patients, which increases safety as interruption of the
glucose control increases the chance of hypo- and
hyperglycemia. For all aspects that require interaction
with the user, the patient should be involved in the de-
sign using appropriate human factors methods such as
usability studies.
66
Especially the user interface is
important, which should be intuitive, guided by clear
marks and text, and indicate the status of the different
components and required actions.
37
Mechanical aspects
such as device shape, size and connections should also
be evaluated. Besides, psychosocial impact of the sys-
tem needs to be assessed and considered in the different
design phases.
5
The artificial pancreas will be worn
during all kinds of activities, so it should ideally be
weather-, play- and sport-proof.
72
Furthermore, the
user manual and training of the patient can add to safe
use of the artificial pancreas. Both have to focus on the
maintenance actions and understanding and recogniz-
ing system failures including how to handle the possible
alarms. The user manual should not be too extensive
and the instruction should be tailored to the patient.
CONCLUSION
Compared to current diabetes treatment, the artifi-
cial pancreas holds promise but adds challenging safety
TABLE 2. Safety of the artificial pancreas system
Topic Safety aspects Mitigation measures
Combining the components Reliability and security wireless communication Integration of devices;
Evaluate functionality and safety of wireless communication and take appropriate measures
Cybersecurity Specify requirements regarding cryptography, secure and authorized communication, and integrity
protection of software and data
Low batteries Minimize power consumption to enable battery life of at least multiple days;
Use of widely available batteries or charger;
Appropriate use of electronic components with high power consumption and storage of essential data
Reliability operating system and software Dedicated operating system and software;
Modular software design;
Safety processor
Alarms Alarm fatigue Restricted number of alarms: only alarms that require action from the patient
No response to alarm Multiple ways of giving alarms;
Evaluate adequacy alarms
User Low acceptance by patients Involve user and psychosocial impact in design;
Weather-, play-, sport-proof system
Difficulties in use Intuitive user-interface that indicates component status and required actions;
User manual and training with focus on required actions
Safety and Design Requirements of the Artificial Pancreas
issues because it combines several components into one
system and takes over glucose control from the patient.
To design a safe artificial pancreas, the configuration
and implementation of the different components
should be directed by risk management. For safety
issues that cannot be sufficiently solved by design,
timely detection of faults is necessary to alarm the
patient. Prerequisites that enable the control algo-
rithms to provide safe closed-loop glucose control are
accurate and reliable input of glucose values, assured
hormone delivery and an efficient user interface.
Ongoing and future out-of-hospital and unsuper-
vised studies will teach us more about the occurrence
of safety issues and the effectiveness of mitigation
measures, but the latter may first have to be demon-
strated in controlled studies.
72
We should, however,
remember that it is not possible to guarantee 100%
safety and insisting on this will limit innovation, while
patients and their families and health care providers
are eagerly waiting for the artificial pancreas to become
available on the market. Perfect should not become the
enemy of good. Therefore, the goal should be to de-
velop an artificial pancreas that is as safe as possible
based on current knowledge and technical possibilities,
for which direction is given in this review. As glucose
control is an evolving process, corrective actions re-
main possible in case of failures as long as these situ-
ations are being noticed by the patient.
The establishment of registries to collect data on
patients’ clinical variables, device use and failures may
contribute to post-market improvements in safety of
artificial pancreas systems. Technological advance-
ments that will likely contribute most to safety are
faster acting insulins, more accurate glucose sensors
and more reliable wireless communication.
FUNDING
This work was supported in part by the European
Commission under the Seventh Framework Pro-
gramme (PCDIAB, grant agreement number 305654)
and JDRF.
CONFLICT OF INTEREST
H.B. is an employee of Inreda Diabetic BV. R.K. is
founder and CTO of Inreda Diabetic BV and holds
patents related to the bihormonal artificial pancreas.
J.H.D.V. served on advisory panels for Insulet and
Johnson & Johnson, and received research support
from Abbott Diabetes Care, Dexcom, and Medtronic.
P.K.H. is founder and CTO of TypeZero technologies,
LLC and holds patents related to the artificial pancreas.
OPEN ACCESS
This article is distributed under the terms of the
Creative Commons Attribution 4.0 International
License (http://creativecommons.org/licenses/by/4.0/),
which permits unrestricted use, distribution, and re-
production in any medium, provided you give appro-
priate credit to the original author(s) and the source,
provide a link to the Creative Commons license, and
indicate if changes were made.
REFERENCES
1
American Diabetes Association. 6. Glycemic targets. Dia-
betes Care 38:S33–S40, 2015.
2
Anhalt, H., and N. J. Bohannon. Insulin patch pumps:
their development and future in closed-loop systems. Dia-
betes Technol. Ther. 12(Suppl 1):S51–S58, 2010.
3
Bakhtiani, P. A., J. El Youssef, A. K. Duell, D. L.
Branigan, P. G. Jacobs, M. R. Lasarev, J. R. Castle, and
W. K. Ward. Factors affecting the success of glucagon
delivered during an automated closed-loop system in type 1
diabetes. J. Diabetes Complicat. 29(1):93–98, 2014.
4
Bakhtiani, P. A., L. M. Zhao, J. El Youssef, J. R. Castle,
and W. K. Ward. A review of artificial pancreas tech-
nologies with an emphasis on bi-hormonal therapy. Dia-
betes Obes. Metab. 15:1065–1070, 2013.
5
Barnard, K. D., T. Wysocki, H. Thabit, M. L. Evans, S.
Amiel, S. Heller, A. Young, R. Hovorka, and C. Angela.
Psychosocial aspects of closed- and open-loop insulin
delivery: closing the loop in adults with Type 1 diabetes in
the home setting. Diabet. Med. 32:601–608, 2015.
6
Beck, R. W., W. V. Tamborlane, R. M. Bergenstal, K. M.
Miller, S. N. DuBose, and C. A. Hall. The T1D Exchange
clinic registry. J. Clin. Endocrinol. Metab. 97:4383–4389,
2012.
7
Bequette, B. W. Challenges and recent progress in the
development of a closed-loop artificial pancreas. Annu.
Rev. Control 36:255–266, 2012.
8
Bequette, B. W. Fault detection and safety in closed-loop
artificial pancreas systems. J. Diabetes Sci. Technol.
8:1204–1214, 2014.
9
Bergenstal, R. M., D. C. Klonoff, S. K. Garg, B. W. Bode,
M. Meredith, R. H. Slover, A. J. Ahmann, J. B. Welsh, S.
W. Lee, and F. R. Kaufman. Threshold-based insulin-
pump interruption for reduction of hypoglycemia. N. Engl.
J. Med. 369(3):224–232, 2013.
10
Blauw, H., A. C. van Bon, R. Koops, J. H. DeVries, and
PCDIAB Consortium. Performance and safety of an inte-
grated bihormonal artificial pancreas for fully automated
glucose control at home. Diabetes Obes. Metab. 18:671–
677, 2016.
11
Cameron, F., B. W. Bequette, D. M. Wilson, B. A. Buck-
ingham, H. Lee, and G. Niemeyer. A closed-loop artificial
pancreas based on risk management. J. Diabetes Sci.
Technol. 5:368–379, 2011.
12
Castle, J. R., J. El Youssef, P. A. Bakhtiani, Y. Cai, J. M.
Stobbe, D. Branigan, K. Ramsey, P. Jacobs, R. Reddy, M.
Woods, and W. K. Ward. Effect of repeated glucagon
doses on hepatic glycogen in Type 1 diabetes: implications
for a bihormonal closed-loop system. Diabetes Care
38:2115–2119, 2015.
BLAUW et al.
13
Castle, J. R., J. M. Engle, J. El Youssef, R. G. Massoud,
and W. K. Ward. Factors influencing the effectiveness of
glucagon for preventing hypoglycemia. J. Diabetes Sci.
Technol. 4:1305–1310, 2010.
14
Castle, J. R., A. Pitts, K. Hanavan, R. Muhly, J. El
Youssef, C. Hughes-Karvetski, B. Kovatchev, and W. K.
Ward. The accuracy benefit of multiple amperometric
glucose sensors in people with type 1 diabetes. Diabetes
Care 35:706–710, 2012.
15
Castle, J. R., and W. K. Ward. Amperometric glucose
sensors: sources of error and potential benefit of redun-
dancy. J. Diabetes Sci. Technol. 4:221–225, 2010.
16
Chassin, L. J., M. E. Wilinska, and R. Hovorka. Evalua-
tion of glucose controllers in virtual environment:
methodology and sample application. Artif. Intell. Med.
32:171–181, 2004.
17
Chernavvsky, D. R., M. D. DeBoer, P. Keith-Hynes, B.
Mize, M. McElwee, S. Demartini, S. F. Dunsmore, C.
Wakeman, B. P. Kovatchev, and M. D. Breton. Use of an
artificial pancreas among adolescents for a missed snack
bolus and an underestimated meal bolus. Pediatr. Diabetes.
17:28–35, 2016.
18
Clarke, W. L., and E. Renard. Clinical requirements for
closed-loop control systems. J. Diabetes Sci Technol. 6:444–
452, 2012.
19
Colberg, S. R., R. Laan, E. Dassau, and D. Kerr. Physical
activity and type 1 diabetes: time for a rewire? J. Diabetes
Sci. Technol. 9(3):609–618, 2015.
20
Damiano, E. R., K. McKeon, F. H. El-Khatib, H. Zheng,
D. M. Nathan, and S. J. Russell. A comparative effec-
tiveness analysis of three continuous glucose monitors: the
navigator, G4 platinum, and enlite. J. Diabetes Sci. Tech-
nol. 8(4):699–708, 2014.
21
Dassau, E., C. C. Palerm, H. Zisser, B. A. Buckingham, L.
Jovanovic, and F. J. Doyle. In silico evaluation platform
for artificial pancreatic beta-cell development—a dynamic
simulator for closed-loop control with hardware-in-the-
loop. Diabetes Technol. Ther. 11:187–194, 2009.
22
Davey, R. J., W. Howe, N. Paramalingam, L. D. Ferreira,
E. A. Davis, P. A. Fournier, and T. W. Jones. The effect of
midday moderate-intensity exercise on postexercise hypo-
glycemia risk in individuals with type 1 diabetes. J. Clin.
Endocrinol. Metab. 98:2908–2914, 2013.
23
Doyle, 3rd, F. J., L. M. Huyett, J. B. Lee, H. C. Zisser, and
E. Dassau. Closed-loop artificial pancreas systems: engi-
neering the algorithms. Diabetes Care. 37:1191–1197, 2014.
24
Elleri, D., J. M. Allen, K. Kumareswaran, L. Leelarathna,
M. Nodale, K. Caldwell, P. Cheng, C. Kollman, A. Haidar,
H. R. Murphy, M. E. Wilinska, C. L. Acerini, D. B.
Dunger, and R. Hovorka. Closed-loop basal insulin deliv-
ery over 36 hours in adolescents with type 1 diabetes:
randomized clinical trial. Diabetes Care 36:838–844, 2013.
25
Elleri, D., M. Biagioni, J. M. Allen, K. Kumareswaran, L.
Leelarathna, K. Caldwell, M. Nodale, M. E. Wilinska, A.
Haidar, P. Calhoun, C. Kollman, N. C. Jackson, A. M.
Umpleby, C. L. Acerini, D. B. Dunger, and R. Hovorka.
Safety, efficacy and glucose turnover of reduced prandial
boluses during closed-loop therapy in adolescents with type
1 diabetes: a randomized clinical trial. Diabetes Obes.
Metab. 17:1173–1179, 2015.
26
Elleri, D., G. Maltoni, J. M. Allen, M. Nodale, K. Ku-
mareswaran, L. Leelarathna, H. Thabit, K. Caldwell, M. E.
Wilinska, P. Calhoun, C. Kollman, D. B. Dunger, and R.
Hovorka. Safety of closed-loop therapy during reduction
or omission of meal boluses in adolescents with type 1
diabetes: a randomized clinical trial. Diabetes Obes. Metab.
16:1174–1178, 2014.
27
Frier, B. M. Hypoglycaemia in diabetes mellitus: epidemi-
ology and clinical implications. Nat. Rev. Endocrinol.
10:711–722, 2014.
28
Garcia, A., A. L. Rack-Gomer, N. C. Bhavaraju, H.
Hampapuram, A. Kamath, T. Peyser, A. Facchinetti, C.
Zecchin, G. Sparacino, and C. Cobelli. Dexcom G4AP: an
advanced continuous glucose monitor for the artificial
pancreas. J. Diabetes Sci. Technol. 7:1436–1445, 2013.
29
Gondhalekar, R., E. Dassau, H. C. Zisser, and F. J. Doyle,
3rd. Periodic-zone model predictive control for diurnal
closed-loop operation of an artificial pancreas. J. Diabetes
Sci. Technol. 7:1446–1460, 2013.
30
Haidar, A., D. Farid, A. St-Yves, V. Messier, V. Chen, D.
Xing, A. S. Brazeau, C. Duval, B. Boulet, L. Legault, and
R. Rabasa-Lhoret. Post-breakfast closed-loop glucose
control is improved when accompanied with carbohydrate-
matching bolus compared to weight-dependent bolus. Di-
abetes Metab. 40:211–214, 2014.
31
Heinemann, L., and L. Krinelke. Insulin infusion set: the
Achilles heel of continuous subcutaneous insulin infusion.
J. Diabetes Sci. Technol. 6:954–964, 2012.
32
Hernando, M. E., G. Garcia-Saez, I. Martinez-Sarriegui,
A. Rodriguez-Herrero, C. Perez-Gandia, M. Rigla, A. de
Leiva, I. Capel, B. Pons, and E. J. Gomez. Automatic data
processing to achieve a safe telemedical artificial pancreas.
J. Diabetes Sci. Technol. 3:1039–1046, 2009.
33
Hinshaw, L., C. Dalla Man, D. K. Nandy, A. Saad, A. E.
Bharucha, J. A. Levine, R. A. Rizza, R. Basu, R. E. Carter,
C. Cobelli, Y. C. Kudva, and A. Basu. Diurnal pattern of
insulin action in type 1 diabetes: implications for a closed-
loop system. Diabetes 62:2223–2229, 2013.
34
Hovorka, R. Closed-loop insulin delivery: from bench to
clinical practice. Nat. Rev. Endocrinol. 7:385–395, 2011.
35
Hovorka, R., D. Elleri, H. Thabit, J. M. Allen, L. Lee-
larathna, R. El-Khairi, K. Kumareswaran, K. Caldwell, P.
Calhoun, C. Kollman, H. R. Murphy, C. L. Acerini, M. E.
Wilinska, M. Nodale, and D. B. Dunger. Overnight closed-
loop insulin delivery in young people with type 1 diabetes:
a free-living, randomized clinical trial. Diabetes Care
37:1204–1211, 2014.
36
Jacobs, P. G., J. El Youssef, J. Castle, P. Bakhtiani, D.
Branigan, M. Breen, D. Bauer, N. Preiser, G. Leonard, T.
Stonex, and W. K. Ward. Automated control of an adap-
tive bihormonal, dual-sensor artificial pancreas and evalu-
ation during inpatient studies. IEEE Trans. Biomed. Eng.
61:2569–2581, 2014.
37
Keith-Hynes, P., S. Guerlain, B. Mize, C. Hughes-
Karvetski, M. Khan, M. McElwee-Malloy, and B. P. Ko-
vatchev. DiAs user interface: a patient-centric interface for
mobile artificial pancreas systems. J. Diabetes Sci. Technol.
7:1416–1426, 2013.
38
Keith-Hynes, P., B. Mize, A. Robert, and J. Place. The
diabetes assistant: a smartphone-based system for real-time
control of blood glucose. Electronics 3:609–623, 2014.
39
Klonoff, D. C., and D. N. Kleidermacher. Now is the time
for a cybersecurity standard for connected diabetes devices.
J. Diabetes Sci. Technol. 10:623–626, 2016.
40
Kovatchev, B. P., S. D. Patek, E. A. Ortiz, and M. D.
Breton. Assessing sensor accuracy for non-adjunct use of
continuous glucose monitoring. Diabetes Technol. Ther.
17:177–186, 2015.
41
Kovatchev, B. P., E. Renard, C. Cobelli, H. C. Zisser,
P. Keith-Hynes, S. M. Anderson, S. A. Brown, D. R.
Safety and Design Requirements of the Artificial Pancreas
Chernavvsky, M. D. Breton, L. B. Mize, A. Farret, J.
Place, D. Bruttomesso, S. Del Favero, F. Boscari, S. Ga-
lasso, A. Avogaro, L. Magni, F. Di Palma, C. Toffanin, M.
Messori, E. Dassau, and F. J. Doyle, 3rd. Safety of out-
patient closed-loop control: first randomized crossover
trials of a wearable artificial pancreas. Diabetes Care
37:1789–1796, 2014.
42
Kowalski, A. J. Can we really close the loop and how soon?
Accelerating the availability of an artificial pancreas: a
roadmap to better diabetes outcomes. Diabetes Technol.
Ther. 11(Suppl 1):S113–S119, 2009.
43
Kropff, J., D. Bruttomesso, W. Doll, A. Farret, S. Galasso,
Y. M. Luijf, J. K. Mader, J. Place, F. Boscari, T. R. Pieber,
E. Renard, and J. H. DeVries. Accuracy of two continuous
glucose monitoring systems: a head-to-head comparison
under clinical research centre and daily life conditions.
Diabetes Obes Metab. 7(4):833–841, 2014.
44
Kropff, J., S. Del Favero, J. Place, C. Toffanin, R. Vi-
sentin, M. Monaro, M. Messori, F. Di Palma, G. Lanzola,
A. Farret, F. Boscari, S. Galasso, P. Magni, A. Avogaro, P.
Keith-Hynes, B. P. Kovatchev, D. Bruttomesso, C. Cobelli,
J. H. DeVries, E. Renard, L. Magni, and A. P. h. consor-
tium. 2 month evening and night closed-loop glucose con-
trol in patients with type 1 diabetes under free-living
conditions: a randomised crossover trial. Lancet Diabetes
Endocrinol. 3:939–947, 2015.
45
Kudva, Y. C., R. E. Carter, C. Cobelli, R. Basu, and A.
Basu. Closed-loop artificial pancreas systems: physiological
input to enhance next-generation devices. Diabetes Care
37:1184–1190, 2014.
46
Leelarathna, L., M. Nodale, J. M. Allen, D. Elleri, K.
Kumareswaran, A. Haidar, K. Caldwell, M. E. Wilinska,
C. L. Acerini, M. L. Evans, H. R. Murphy, D. B. Dunger,
and R. Hovorka. Evaluating the accuracy and large inac-
curacy of two continuous glucose monitoring systems. Di-
abetes Technol. Ther. 15:143–149, 2013.
47
Ly, T. T., M. D. Breton, P. Keith-Hynes, D. De Salvo, P.
Clinton, K. Benassi, B. Mize, D. Chernavvsky, J. Place, D.
M. Wilson, B. P. Kovatchev, and B. A. Buckingham.
Overnight glucose control with an automated, unified
safety system in children and adolescents with type 1 dia-
betes at diabetes camp. Diabetes Care 37:2310–2316,
2014.
48
Ly, T. T., J. A. Nicholas, A. Retterath, E. M. Lim, E. A.
Davis, and T. W. Jones. Effect of sensor-augmented insulin
pump therapy and automated insulin suspension vs stan-
dard insulin pump therapy on hypoglycemia in patients
with type 1 diabetes: a randomized clinical trial. JAMA
310:1240–1247, 2013.
49
Ly, T. T., A. Roy, B. Grosman, J. Shin, A. Campbell, S.
Monirabbasi, B. Liang, R. von Eyben, S. Shanmugham, P.
Clinton, and B. A. Buckingham. Day and night closed-loop
control using the integrated medtronic hybrid closed-loop
system in type 1 diabetes at diabetes camp. Diabetes Care
38:1205–1211, 2015.
50
Mauseth, R., I. B. Hirsch, J. Bollyky, R. Kircher, D.
Matheson, S. Sanda, and C. Greenbaum. Use of a ‘‘fuzzy
logic’’ controller in a closed-loop artificial pancreas. Dia-
betes Technol. Ther. 15:628–633, 2013.
51
McMahon, S. K., L. D. Ferreira, N. Ratnam, R. J. Davey,
L. M. Youngs, E. A. Davis, P. A. Fournier, and T. W.
Jones. Glucose requirements to maintain euglycemia after
moderate-intensity afternoon exercise in adolescents with
type 1 diabetes are increased in a biphasic manner. J. Clin.
Endocrinol. Metab. 92:963–968, 2007.
52
Nimri, R., I. Muller, E. Atlas, S. Miller, A. Fogel, N.
Bratina, O. Kordonouri, T. Battelino, T. Danne, and M.
Phillip. MD-logic overnight control for 6 weeks of home
use in patients with type 1 diabetes: randomized crossover
trial. Diabetes Care 37:3025–3032, 2014.
53
Nimri, R., and M. Phillip. Artificial pancreas: fuzzy logic
and control of glycemia. Curr. Opin. Endocrinol. Diabetes
Obes. 21:251–256, 2014.
54
O’Grady, M. J., A. J. Retterath, D. B. Keenan, N. Kurtz,
M. Cantwell, G. Spital, M. N. Kremliovsky, A. Roy, E. A.
Davis, T. W. Jones, and T. T. Ly. The use of an automated,
portable glucose control system for overnight glucose
control in adolescents and young adults with type 1 dia-
betes. Diabetes Care 35:2182–2187, 2012.
55
Oron, T., A. Farfel, I. Muller, S. Miller, E. Atlas, R. Nimri,
and M. Phillip. A remote monitoring system for artificial
pancreas support is safe, reliable, and user friendly. Dia-
betes Technol. Ther. 16:699–705, 2014.
56
Patek, S. D., L. Magni, E. Dassau, C. Karvetski, C. Tof-
fanin, G. De Nicolao, S. Del Favero, M. Breton, C. D.
Man, E. Renard, H. Zisser, F. J. Doyle, 3rd, C. Cobelli, B.
P. Kovatchev, and G. International Artificial Pancreas
Study. Modular closed-loop control of diabetes. IEEE
Trans. Biomed. Eng. 59:2986–2999, 2012.
57
Paul, N., T. Kohno, and D. C. Klonoff. A review of the
security of insulin pump infusion systems. J. Diabetes Sci.
Technol. 5:1557–1562, 2011.
58
Peyser, T., E. Dassau, M. Breton, and J. S. Skyler. The
artificial pancreas: current status and future prospects in
the management of diabetes. Ann. N. Y. Acad. Sci.
1311:102–123, 2014.
59
Picton, P. E., M. Yeung, N. Hamming, L. Desborough, E.
Dassau, and J. A. Cafazzo. Advancement of the artificial
pancreas through the development of interoperability
standards. J. Diabetes Sci. Technol. 7:1066–1070, 2013.
60
Place, J., A. Robert, N. Ben Brahim, P. Keith-Hynes, A.
Farret, M. J. Pelletier, B. Buckingham, M. Breton, B.
Kovatchev, and E. Renard. DiAs web monitoring: a real-
time remote monitoring system designed for artificial pan-
creas outpatient trials. J. Diabetes Sci Technol. 7:1427–
1435, 2013.
61
Reddy, M., P. Herrero, M. El Sharkawy, P. Pesl, N.
Jugnee, H. Thomson, D. Pavitt, C. Toumazou, D. John-
ston, P. Georgiou, and N. Oliver. Feasibility study of a bio-
inspired artificial pancreas in adults with type 1 diabetes.
Diabetes Technol. Ther. 16:550–557, 2014.
62
Revert, A., F. Garelli, J. Pico, H. De Battista, P. Rossetti,
J. Vehi, and J. Bondia. Safety auxiliary feedback element
for the artificial pancreas in type 1 diabetes. IEEE Trans.
Biomed. Eng. 60:2113–2122, 2013.
63
Russell, S. J. Progress of artificial pancreas devices towards
clinical use: the first outpatient studies. Curr. Opin. En-
docrinol. Diabetes Obes. 22:106–111, 2015.
64
Russell, S. J., F. H. El-Khatib, M. Sinha, K. L. Magyar, K.
McKeon, L. G. Goergen, C. Balliro, M. A. Hillard, D. M.
Nathan, and E. R. Damiano. Outpatient glycemic control
with a bionic pancreas in type 1 diabetes. N. Engl. J. Med.
371:313–325, 2014.
65
Sanchez, R. M. The critical path from pump to pancreas:
the impact of FDA regulation on the development of a
closed-loop diabetes management system. Food Drug Law
J. 68:53–76, 2013.
66
Schaeffer, N. E. The role of human factors in the design
and development of an insulin pump. J. Diabetes Sci.
Technol. 6:260–264, 2012.
BLAUW et al.
67
Schiavon, M., C. Dalla Man, Y. C. Kudva, A. Basu, and C.
Cobelli. In silico optimization of basal insulin infusion rate
during exercise: implication for artificial pancreas. J. Dia-
betes Sci. Technol. 7:1461–1469, 2013.
68
Stenvers, D. J., J. H. DeVries, and S. E. la Fleur. What’s
the Time? Does the Artificial Pancreas Need to Know?
Diabetes 62:2173–2174, 2013.
69
Tauschmann, M., and R. Hovorka. Insulin pump therapy
in youth with type 1 diabetes: toward closed-loop systems.
Expert Opin. Drug Deliv. 11:943–955, 2014.
70
Thabit, H., and R. Hovorka. Bringing closed-loop home:
recent advances in closed-loop insulin delivery. Curr. Opin.
Endocrinol. Diabetes Obes. 21:95–101, 2014.
71
Thabit, H., M. Tauschmann, J. M. Allen, L. Leelarathna,
S. Hartnell, M. E. Wilinska, C. L. Acerini, S. Dellweg, C.
Benesch, L. Heinemann, J. K. Mader, M. Holzer, H.
Kojzar, J. Exall, J. Yong, J. Pichierri, K. D. Barnard, C.
Kollman, P. Cheng, P. C. Hindmarsh, F. M. Campbell, S.
Arnolds, T. R. Pieber, M. L. Evans, D. B. Dunger, R.
Hovorka, and A. P. Consortium and A. P. h. Consortium.
Home use of an artificial beta cell in type 1 diabetes. N Engl
J Med. 373:2129–2140, 2015.
72
The Content of Investigational Device Exemption (IDE)
and Premarket Approval (PMA) Applications for Artificial
Pancreas Device Systems. Center for Devices and Radio-
logical Health: U.S. Department of Health and Human
Services, Food and Drug Administration, 2012.
73
Turksoy, K., L. T. Quinn, E. Littlejohn, and A. Cinar. An
integrated multivariable artificial pancreas control system.
J. Diabetes Sci. Technol. 8:498–507, 2014.
74
van Bon, A. C., Y. M. Luijf, R. Koebrugge, R. Koops, J. B.
Hoekstra, and J. H. Devries. Feasibility of a portable bi-
hormonal closed-loop system to control glucose excursions
at home under free-living conditions for 48 hours. Diabetes
Technol. Ther. 16:131–136, 2014.
75
Visentin, R., C. Dalla Man, Y. C. Kudva, A. Basu, and C.
Cobelli. Circadian variability of insulin sensitivity: physi-
ological input for in silico artificial pancreas. Diabetes
Technol. Ther. 17:1–7, 2015.
76
Ward, W. K., J. R. Castle, and J. El Youssef. Safe glycemic
management during closed-loop treatment of type 1 dia-
betes: the role of glucagon, use of multiple sensors, and
compensation for stress hyperglycemia. J. Diabetes Sci.
Technol. 5:1373–1380, 2011.
77
Wilinska, M. E., E. S. Budiman, M. B. Taub, D. Elleri, J.
M. Allen, C. L. Acerini, D. B. Dunger, and R. Hovorka.
Overnight closed-loop insulin delivery with model predic-
tive control: assessment of hypoglycemia and hyper-
glycemia risk using simulation studies. J. Diabetes Sci.
Technol. 3:1109–1120, 2009.
78
Zisser, H. Clinical hurdles and possible solutions in the
implementation of closed-loop control in type 1 diabetes
mellitus. J. Diabetes Sci. Technol. 5:1283–1286, 2011.
79
Zisser, H., E. Renard, B. Kovatchev, C. Cobelli, A.
Avogaro, R. Nimri, L. Magni, B. A. Buckingham, H. P.
Chase, F. J. Doyle, 3rd, J. Lum, P. Calhoun, C. Kollman,
E. Dassau, A. Farret, J. Place, M. Breton, S. M. Anderson,
C. Dalla Man, S. Del Favero, D. Bruttomesso, A. Filippi,
R. Scotton, M. Phillip, E. Atlas, I. Muller, S. Miller, C.
Toffanin, D. M. Raimondo, G. De Nicolao, R. W. Beck,
and G. Control to Range Study. Multicenter closed-loop
insulin delivery study points to challenges for keeping
blood glucose in a safe range by a control algorithm in
adults and adolescents with type 1 diabetes from various
sites. Diabetes Technol. Ther. 16:613–622, 2014.
Safety and Design Requirements of the Artificial Pancreas
