USE CASE

Closed-loop control where a mistake is an emergency.

An artificial pancreas reads blood glucose and doses insulin automatically — a closed control loop on a living patient. What makes it hard isn't keeping glucose down after a meal; it's doing that without ever pushing it too low, because a hypoglycemic event isn't a missed setpoint, it's a medical emergency. This program models the physiology, builds the controller, walks straight into that safety trap, and shows the safety layer that gets out of it — then proves it across a virtual patient cohort.

Blood glucose over a day inside the 70-180 mg/dL target band — the open loop spiking after meals while the closed loop holds the peaks down

100%

time-in-range (hybrid + safety)

hypoglycemic events

81% → 100%

time-in-range gain

40 / 40

cohort patients TIR ≥ 80%

design notebooks

safety-critical

control

THE CHALLENGE

A meal is a disturbance you can't reject in time.

Carbohydrate hits the bloodstream in minutes; injected insulin takes far longer to act. So a meal sends glucose spiking, and without control it climbs past 200 mg/dL and stays high for hours. The model — a Bergman minimal glucose-insulin system with a meal glucose-appearance term — reproduces that postprandial excursion exactly, and quantifies the damage: only 81% of the day inside the healthy 70-180 band, nearly a fifth of it hyperglycemic. That's the problem a closed loop is there to fix.

Open-loop blood glucose over a day spiking above the 180 mg/dL line after each meal, with the target band shaded — The uncontrolled day: three meals, three spikes past 180 mg/dL, hours spent hyperglycemic. The shaded band is the 70-180 target; basal insulin alone can't keep the meals inside it. This is the baseline every closed-loop controller has to beat.

Closed-loop glucose tracking inside the target band, the controller pulling the post-meal peaks down compared with the open loop — Closing the loop: a feedback controller doses insulin off the glucose reading and pulls the post-meal peaks down — time-in-range jumps from 81% to 94%. But look at the dips after each meal: the controller's own overshoot is starting to chase glucose toward the low end. That's the trap.

THE TRAP

The harder you chase the highs, the closer you get to the lows.

It's tempting to turn the controller up: more aggressive insulin dosing flattens the post-meal peaks and pushes time-in-range higher still. But insulin keeps acting after glucose has already turned around, so a hot controller overshoots downward — straight into hypoglycemia. The program makes the trap explicit: chasing the last few points of time-in-range with gain alone causes hypo events. In a real device that's not a worse score, it's a 2 a.m. ambulance. The answer isn't a better gain — it's a safety layer.

Time-in-range and hypoglycemia risk both rising as controller gain increases — the safety trap — The hypoglycemia trap, quantified: as controller gain rises, time-in-range improves — and so does hypo risk, until the aggressive loop is causing dangerous lows. The two goals pull against each other, which is exactly why a glucose controller can't just be tuned for performance.

A low-glucose-suspend safety layer lifting the post-meal nadir above 70 mg/dL while keeping time-in-range high — The way out: a predictive low-glucose-suspend that cuts insulin before glucose crosses the floor, paired with a meal-announcement feedforward. It lifts the post-meal nadir from 66 to 88 mg/dL, zeroes the hypo time, and still holds 100% time-in-range — performance and safety at once, which the gain knob alone couldn't buy.

A virtual-patient cohort's time-in-range distribution, all patients high and none hypoglycemic — Does it generalize? A 40-patient virtual cohort, spread across insulin sensitivity and meal size, all run on the same hybrid controller: every patient lands at high time-in-range and not one has a hypoglycemic event. A controller that works on one patient isn't a device; one that's safe across the cohort is the start of one.

VALIDATION

Every number is one you can re-run.

The sign-off notebook re-derives each requirement from the same physiology model the program builds.

	Result	Requirement
Open-loop time-in-range	81%	baseline
Hybrid + safety TIR	100%	R-03
Hypoglycemic events (hybrid)	0	R-04 = 0
Cohort TIR ≥ 80%	40 / 40	R-05
Requirements verified	6 / 6	PASS

HONEST SCOPE

A teaching & controls model, not a medical device.

The patient is the Bergman minimal model — glucose, insulin action and plasma insulin — not the high-fidelity UVA/Padova simulator used for regulatory work; the cohort is a simple spread of physiological parameters, and the CGM and pump are idealized. This is a controls and safety-engineering model, explicitly not a medical device or clinical advice. It is exactly the fidelity that builds the intuition and the control logic — the meal disturbance, the hypoglycemia trap, the value of a safety layer, and cohort robustness — on reproducible numbers, before a high-fidelity simulator and a regulated development process. And it pairs with the memory-safe-Rust path: a controller where 'verified' has to mean something.

Model your own physiological controller.

Book a walkthrough and we'll set up your patient model, disturbance and safety constraints, and run the closed-loop and cohort studies live.

Book a demo Browse the demos