www.postersession.com

Technology has improved the safety of air travel by enabling the automation of complex safety critical tasks; tasks that were formerly performed manually by the pilot. The 777 Fly By Wire (FBW) system helps the pilot by preventing stalls, adhering to bank angle limits, and preventing the over stressing of the airframe. For the Boeing 777, these safety features are the default operating mode of the FBW flight controls system.

To facilitate the adoption of the technology, the pilots user interface to the 777 plane - the column, wheel and rudder pedals, including the force-feel feedback system as well as the primary flight instruments - remains the same as in prior Boeing models. See figure 1.

Technology development within the Artificial Pancreas Device System (APDS) research sector continues to advance. We propose an AP device system-level mode logic that employs the same design and human factors strategies as the Boeing 777 primary flight controls.

Methods Conclusions

Proposal for Artificial Pancreas device system-level mode logic R. Kircher MS, D. Matheson MS, R. Mauseth MD

Dose Safety, Inc., Seattle, WA

Bibliography Digital Avionics Handbook, Second Edition - 2 Volume Set Edited

by Cary R . Spitzer CRC Press 2000 http://www.boeing.com/commercial/safety/technology.html

The Boeing 777 FBW Primary Flight Control System and the APDS have similar safety and user requirements. We believe that the proposed requirements and mode logic are suitable for APDS system development, regulatory approval, and commercialization. The Dose Safety AP controller is designed for round-the-clock, fully automated, closed loop control of blood glucose. No premeal or correction boluses are required. Our controller is designed to allow for user initiated boluses at any time.

Introduction Results Three system-level APDS design strategies:

1) Automation of complex, safety-critical tasks

Air transport pilot tasks are automated by combining Newtonian physics models of airplane dynamics with modern control theory techniques. The model inputs required for flight control are all known and measurable. Those include: airplane speed, altitude, pitch/roll and yaw angles, weight distribution.

Type-1 diabetics must maintain safe blood sugars while preventing hypoglycemia. Those tasks include daily monitoring blood sugars; adjusting the basal insulin schedule, estimating mealtime carbs; calculating mealtime and correction insulin doses. The AP automation problem is more challenging because blood sugar dynamics are affected by conditions that are not readily measurable: health, stress, illness, drug interactions.

2) User interface consistent with past experience

The B777 cockpit maintained a flight control system operation that is consistent with a pilot’s past training and experience. This means that however different the actual flight control system architecture is from previous Boeing airplanes, the presentation to the pilot is that of a conventionally controlled mechanical system.

The same design strategy may be applied to the APDS. Retain insulin pump and CGM user interfaces currently used to manually control blood sugars, and add new indicators that inform the diabetic about AP status.

3) Automation by default with user overrides

The improved airplane handling quality and safety features are automatically provided without pilot action, yet the pilot may at any time bypass the advanced features and fly the airplane as if it had a mechanical system.

For the APDS, fully automated blood sugar control is the default, and the diabetic may bypass the automaton at any time and use the CGM and pump as they did before.

Figure 1 B777: with fly-by-wire flight controls

Commercially available Insulin pump

Proposed AP status indicator showing auto-

dosing in progress

Commercially available CGM

Figure 2 APDS state transition diagram

Figure 3 APDS mode control logic

Figure 4 Example of device with AP status indicator

To implement the system-level APDS design strategies, we propose three APDS operational states (Figure 2): •  Init. Setup: When the system is powered up, this is the initial state. During operation, this state is automatically entered when subsystem warnings or errors are detected. •  Auto Dosing: The APDS defaults to Auto Dosing when all subsystems are operating normally and safe blood sugars are predicted. •  Manual Dosing: The system enters this state when Auto Dosing is prevented, or when the diabetic manually initiates an insulin dose.

The mode logic shown below in Figure 3 implements the above state transitions.

Figure 4 shows a possible integration of AP functionality with commercially available infusion pump and CGM. The infusion pump screen remains unchanged. The only change to the CGM screen is the addition of the AP status indicator light.