Risk analysis for the design of a safe artificial pancreas control system

Closed-loop glucose control has the potential to improve the glycemic control in patients with diabetes mellitus type 1. Such an artificial pancreas (AP) should keep the user safe despite all disturbances and faults. The objective of this paper is to analyze those perturbations according to their effects on the glycemic status, and thereby supporting an informed design process of the control system. As suggested by the international standard ISO 14971 for risk management of medical devices, the well proven failure modes and effects analysis (FMEA) was chosen as instrument. An FMEA scheme was modified for this purpose and applied to a single-hormone system with subcutaneous and intraperitoneal routes for glucose sensing and insulin administration. Faults that imply urgent danger and thus require fast detection and diagnosis were identified and distinguished from disturbances that can be sufficiently addressed by basic control functions, e.g. by adaptive control algorithms. Requirements and testing criteria for basic control functions as well as fault detection and diagnosis functions can be derived from the provided overview.