Magnetic interference mitigation in medical monitoring systems

Abstract

An analyte sensor includes an application-specific integrated circuit (ASIC), sensor hardware, and a communication module. The ASIC is communicatively coupled to the sensor hardware and the communication module. The ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module. The communication module is configured to communicate output data based on the output signal to one or more external devices. The ASIC comprises a magnetic interference detection element configured to indicate when magnetic interference is represented in a measurement signal generated by the sensor hardware. The analyte sensor is configured to disqualify sensor data associated with the analyte sensor in response to the magnetic interference detection element indicating a presence of magnetic interference in a measurement signal generated by the sensor hardware.

Description

MAGNETIC INTERFERENCE MITIGATION IN MEDICAL MONITORING SYSTEMSCROSS-REFERENCE TO RELATED APPLICATION(S)

[0001] This application claims priority to United States Provisional Patent Application No. 63 / 600,535, filed on November 17, 2023, and entitled "MAGNETIC INTERFERENCE MITIGATION IN MEDICAL MONITORING SYSTEMS", the entirety of which is incorporated herein by reference for all purposes.BACKGROUND

[0002] On-body medical sensors are designed to monitor and collect various physiological data from a patient's body. On-body medical sensors are utilized in a wide range of healthcare applications, such as remote patient monitoring, fitness tracking, the management of chronic conditions (e.g., diabetes), and / or others. On-body medical sensors can provide continuously updated, real-time data to healthcare providers and patients, which can facilitate improved diagnosis, treatment, and / or management of patient conditions. Example on-body medical sensors include, but are not limited to, wearable fitness trackers, electrocardiogram (ECG) monitors, temperature sensors, and continuous glucose monitors (CGMs).

[0003] With the prevalence of electronic devices, on-body medical sensors can be exposed to magnetic interference. Magnetic interference (also referred to as electromagnetic interference (EMI)) is the disruption or degradation of the performance of electronic devices or systems caused by the presence of magnetic or electromagnetic signals. Magnetic interference can manifest as unwanted electrical noise or signals that affect the proper functioning of electronic equipment. Magnetic interference can be caused by various types of components, such as switching power supplies, variable frequency drives, digital communication systems, switching digital logic circuits, AC wiring, transformers, solenoids, and / or other components. Such components are used in various types of devices that users can regularly encounter, such as wireless power transmission systems (e.g., wireless charging systems), position detection devices, RFID transponders and readers, induction cooking appliances and ovens, lighting systems, electric motors, smart home devices, wireless communication equipment, and / or others.

[0004] Magnetic interference can pose significant challenges for on-body medical sensors. For instance, in the case of CGM on-body medical sensors, magnetic interferencecan affect the accuracy and / or quality of sensor data (e.g., blood glucose measurements). Inaccurate and / or low-quality blood glucose measurements can lead patients to make sub-optimal lifestyle choices and / or can lead healthcare providers to make sub-optimal patient care decisions.

[0005] Accordingly, there is an ongoing need and desire to develop systems and techniques for mitigating the effects that magnetic interference can have on on-body medical sensors.SUMMARY

[0006] The purpose and advantages of the disclosed subject matter will be set forth in and apparent from the description that follows, as well as will be learned by practice of the disclosed subject matter. Additional advantages of the disclosed subject matter will be realized and attained by the methods and systems particularly pointed out in the written description and claims hereof, as well as from the drawings.

[0007] To achieve these and other advantages and in accordance with the purpose of the disclosed subject matter, as embodied and broadly described, the disclosed subject matter includes components of a medical sensor (e.g., an on-body medical sensor), such as an analyte sensor or a glucose sensor. Example configurations for a medical sensor can comprise an analyte sensor that includes an application-specific integrated circuit (ASIC), sensor hardware, and a communication module. The medical hardware can be configured to be partially inserted into a body of a patient. As an example, the medical hardware can be configured to detect body temperature, heart rate, analyte levels, motion readings, and / or other information. Analytes measured by the analyte sensors can include, by way of example and not limitation, glucose, ketones, lactate, oxygen, hemoglobin A1C, albumin, alcohol, alkaline phosphatase, alanine transaminase, aspartate aminotransferase, bilirubin, blood urea nitrogen, calcium, carbon dioxide, chloride, creatinine, hematocrit, lactate, magnesium, oxygen, pH, phosphorus, potassium, sodium, total protein, uric acid, cortisol, etc. The ASIC can be communicatively coupled to the medical hardware and communication module. The ASIC can be configured to receive measurement signals from the medical hardware and provide an output signal to the communication module. The communication module can be configured to communicate output data based on the output signal to one or more external devices.

[0008] A medical sensor may comprise or implement various types of components, hardware, logic, and / or executable instructions to mitigate the effect that magnetic interference can have on sensor operation and / or data.

[0009] According to aspects of the disclosed subject matter, the ASIC can include a magnetic interference detection element that is configured to indicate when magnetic interference is represented in a measurement signal generated by the sensor hardware. The ASIC and the sensor hardware can be coupled via a work channel, a reference channel, and / or a counter channel, or two or more of any of those channels. The magnetic interference detection element can be implemented at the work channel, the reference, channel, and / or the counter channel, or any multiples of those channels.

[0010] The magnetic interference detection element may include a narrow band filter that is configured to detect magnetic interference associated with a frequency within a range of about 15 kHz to about 300kHz. The narrow band filter may also be configured to detect magnetic interference associated with a frequency of about 130 kHz to about 140 kHz (e.g., about 134 kHz, or about 134.2 kHz). The magnetic interference filter may include additional components, such as a buffer, a rectifier, a comparator, and digital logic.

[0011] The analyte sensor can be configured to disqualify one or more measurement signals, one or more output signals, or one or more output data in response to the magnetic interference detection element indicating the presence of magnetic interference in the measurement signal generated by the sensor hardware. Disqualifying the measurement signal(s), the output signal(s), and / or the output data can include associating a disqualification flag with the measurement signal(s), the output signal(s), and / or the output data. The disqualification flag may comprise a data object in any suitable form (e.g., a bit or byte sequence, a binary value) and may be stored in any suitable data location. The disqualification flag may cause the analyte sensor (and / or other devices) to disqualify the measurement signal(s), the output signal(s), and / or the output data from being used as (or in determining) medical measurements (e.g., blood glucose levels) for presentation to human users and / or for use by other devices (e.g., an insulin pump). In some instances, the digital logic of the magnetic interference detection element is configured to set the disqualification flag in response to detecting magnetic interference in the measurement signal generated by the sensor hardware. In someinstances, additional or alternative actions may be performed on data associated with a disqualification flag as described herein.

[0012] According to aspects of the disclosed subject matter, the ASIC may be in communication with a multi-band antenna configured to detect (i) near-field communication (NFC) signals and (ii) magnetic interference signals. The multi-band antenna can be configured to detect magnetic interference signals within a range of about 15 kHz to about 300 kHz. The multi-band antenna can comprise one or more matching networks that facilitate impedance matching for (i) the NFC signals and (ii) the magnetic interference signals. The antenna can also be a multi-band antenna including detection of the magnetic interference in addition to other communication channel frequencies (e.g., NFC and / or Bluetooth) or other electromagnetic interference frequencies.

[0013] The analyte sensor can be configured to disqualify one or more measurement signals, one or more output signals, or one or more output data in response to the dual or multi band antenna detecting a presence of (i) NFC signals or (ii) magnetic interference signals or (iii) other communication or electromagnetic interference signals. Disqualifying the measurement signal(s), the output signal(s), or the output data can include associating a disqualification flag with the measurement signal(s), the output signal(s), or the output data. The disqualification flag may comprise a data object in any suitable form (e.g., a bit or byte sequence, a binary value) and may be stored in any suitable data location. The disqualification flag may cause the analyte sensor (and / or other devices) to disqualify the measurement signal(s), the output signal(s), and / or the output data from being used as (or in determining) medical measurements (e.g., blood glucose levels) for presentation to human users and / or for use by other devices (e.g., an insulin pump). The disqualification flag can indicate whether disqualification is in response to the multiband antenna detecting (i) NFC signals or (ii) magnetic interference signals.

[0014] According to aspects of the disclosed subject matter, the ASIC can include a magnetic interference filter that intervenes between the sensor hardware and the ASIC. The magnetic interference filter can be configured to filter magnetic interference in the measurement signal generated by the sensor hardware. The magnetic interference filtered by the magnetic interference filter can be associated with a frequency within a range of about 130 kHz to about 140 kHz or 15 kHz to 300 kHz. The magnetic interferencefilter can include a resistive element and a capacitive element. The resistive element can include a resistance within a range of about 28K Ohms to about 38K Ohms, or a resistance within a range of about IK Ohms to about 100K Ohms. The capacitive element comprises a capacitance within a range of about 24 pF to about 30 pF, or a capacitance within a range of about 1 pF to about 1 nF.

[0015] Implementing the components, structures, and / or techniques described herein to facilitate mitigation of the effect of magnetic interference on medical sensor performance can contribute to stable and / or reliable medical sensor performance, notwithstanding proximity to sources of magnetic interference. Such functionality can provide patients and practitioners with medical sensor data (e.g., glucose measurements) that are not distorted by magnetic interference, which can enable patients and practitioners to make informed lifestyle, diagnostic, and / or treatment decisions.

[0016] The accompanying drawings, which are incorporated in and constitute part of this specification, are included to illustrate and provide a further understanding of the methods and systems of the disclosed subject matter. Together with the description, the drawings explain the principles of the disclosed subject matter.BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The details of the subject matter set forth herein, both as to its structure and operation, may be apparent by study of the accompanying figures, in which like reference numerals refer to like parts.

[0018] FIG. 1 is a diagram illustrating an example sensor and a receiver for communication with the example sensor according to example embodiments of the disclosed subject matter.

[0019] FIG. 2 is a diagram illustrating functional blocks of the sensor according to example embodiments of the disclosed subject matter.

[0020] FIG. 3 is a diagram illustrating an example interface between components of the sensor according to example embodiments of the disclosed subject matter.

[0021] FIG. 4 is a diagram illustrating an example of a normal operating condition of the sensor according to example embodiments of the disclosed subject matter.

[0022] FIG. 5 is a diagram illustrating example operations of the sensor according to example embodiments of the disclosed subject matter.

[0023] FIG. 6 is a diagram illustrating example operations of the sensor in an error condition according to example embodiments of the disclosed subject matter.

[0024] FIG. 7 is a diagram illustrating example states of an application-specific integrated circuit of the sensor according to example embodiments of the disclosed subject matter.

[0025] FIG. 8 is a diagram illustrating example states of a communication module of the sensor according to example embodiments of the disclosed subject matter.

[0026] FIGS. 9A-9B is a diagram illustrating example functionality of the sensor and messages between components of the sensor during an example activation operation.

[0027] FIG. 10 is a diagram illustrating example functionality of the sensor and messages between components of the sensor during an example insertion detection operation.

[0028] FIG. 11 is a diagram illustrating example functionality of the sensor and messages between components of the sensor during an example measurement operation.

[0029] FIG. 12 is a diagram illustrating example states of a lifecycle of an example task of the sensor.

[0030] FIG. 13 is a diagram illustrating example functionality of a component of the sensor upon receiving an interrupt request according to example embodiments of the disclosed subject matter.

[0031] FIG. 14 is a chart illustrating low-power detection and responses according to example embodiments of the disclosed subject matter.

[0032] FIGS. 15A-15B is a diagram illustrating example functionality of the sensor and messages between components of the sensor during an example brownout handling operation.

[0033] FIGS. 16A-16B is a diagram illustrating example operations of the sensor in an error condition according to example embodiments of the disclosed subject matter.

[0034] FIG. 17 is a diagram illustrating example functionality of the sensor and messages between components of the sensor during an example error termination operation.

[0035] FIG. 18 is a diagram illustrating example functionality of the sensor and messages between components of the sensor during an example normal termination operation.

[0036] FIG. 19 is a chart illustrating temperature detection and responses according to example embodiments of the disclosed subject matter.

[0037] FIGS. 20A-20B is a diagram illustrating example functionality of the sensor and receiver and messages between the sensor and receiver during an example connection operation.

[0038] FIG. 21 is a diagram illustrating example functionality of the sensor and receiver and messages between the sensor and receiver during an example shutdown operation.

[0039] FIG. 22 is a diagram illustrating example functionality of a measurement along a thermistor of the sensor according to example embodiments of the disclosed subject matter.

[0040] FIG. 23 is a diagram illustrating example functionality of an analog front end of the sensor according to example embodiments of the disclosed subject matter.

[0041] FIG. 24 is a diagram illustrating example functionality of an ASIC of a sensor according to example embodiments of the disclosed subject matter.

[0042] FIG. 25 is a diagram of an example circuit for reading values for an analyte sensor.

[0043] FIG. 26 is a diagram of an example circuit for reading values for an analyte sensor.

[0044] FIG. 27 is a diagram of an example circuit for a variable floating poise voltage generator.

[0045] FIG. 28 is a diagram of an example circuit with a sensor with a floating variable poise voltage circuit in a measurement configuration.

[0046] FIG. 29 is a diagram of an example circuit with a sensor with a floating variable poise voltage circuit in a calibration configuration.

[0047] FIG. 30 is a diagram of an example circuit for a variable floating poise voltage generator.

[0048] FIG. 31 is a diagram of an example circuit for a variable floating poise voltage generator.

[0049] FIG. 32 is a diagram of an example circuit for a variable floating poise voltage generator.

[0050] FIG. 33 is a diagram of an example circuit for a variable floating poise voltage generator.

[0051] FIG. 34 is a diagram of an example circuit for a variable floating poise voltage generator.

[0052] FIG. 35 is a diagram illustrating example functionality of the sensor and receiver and messages between the sensor and receiver during an example connection operation.

[0053] FIG. 36 is a perspective view of an on-body unit in accordance with example embodiments of the disclosed subject matter.

[0054] FIG. 37 is a perspective view in partial cross-section of an on-body unit of FIG. 36 in accordance with example embodiments of the disclosed subject matter.

[0055] FIG. 38 and FIG. 39 are perspective views of components of an inserter in accordance with example embodiments of the disclosed subject matter.

[0056] FIG. 40 is a sectional view of the component of the inserter of FIG. 39 in accordance with example embodiments of the disclosed subject matter.

[0057] FIG. 41 and FIG. 42 are perspective views of components of an inserter in accordance with example embodiments of the disclosed subject matter.

[0058] FIG. 43 is a sectional view of the component of FIG. 42 in accordance with example embodiments of the disclosed subject matter.

[0059] FIG. 44 is a sectional view of an inserter in accordance with example embodiments of the disclosed subject matter.

[0060] FIG. 45 is a diagram illustrating example aspects of a magnetic interference filter for a sensor according to example embodiments of the disclosed subject matter.

[0061] FIG. 46 is a diagram illustrating example aspects of a magnetic interference detection element for an ASIC of a sensor according to example embodiments of the disclosed subject matter.

[0062] FIG. 47 is another diagram illustrating example aspects of a magnetic interference detection element for an ASIC of a sensor according to example embodiments of the disclosed subject matter.

[0063] FIG. 48 is a diagram illustrating example aspects of a multi-band antenna for an ASIC of a sensor according to example embodiments of the disclosed subject matter.DETAILED DESCRIPTION

[0064] Reference will now be made in detail to the various example embodiments of the disclosed subject matter, example embodiments of which are illustrated in the accompanying drawings. Structures, components, and corresponding methods of operation of the disclosed subject matter will be described in conjunction with the detailed description.

[0065] The systems and methods presented herein can be used in conjunction with a sensor used in a monitoring system, such as a medical monitoring system. As used herein,"medical sensor" or "sensor" can refer to any device capable of receiving sensor information from a user useful for medical purposes, including, for purpose of illustration but not limited to, body temperature sensors, blood pressure sensors, pulse or heart-rate sensors, glucose level sensors, analyte sensors, physical activity sensors, body movement sensors, or any other sensors useful for medical purposes. The purpose and advantages of the disclosed subject matter will be set forth and apparent from the description that follows. Additional advantages of the disclosed subject matter will be realized and attained by the methods, apparatus, and devices particularly pointed out in the written description and claims thereof, as well as from the appended drawings.

[0066] A medical monitoring system 100 (or simply "system 100") can include a system of components designed to provide monitoring of medical statistics about a human or animal body or can provide for other medical operations based on the configurations of the various components. For example, a medical monitoring system 100 can provide continuous glucose monitoring to users or can provide for the delivery of drugs and other medicants. As embodied herein, the system 100 can include a medical device, also referred to as a sensor 110 worn by the user or attached / attachable to the body for which information is being collected. As embodied herein, the sensor 110 can be a sealed, disposable device, to improve ease of use and reduce the risk of tampering, as discussed further herein. The medical monitoring system 100 can further include a data reading device (also referred to as "receiver 120") configured as described herein to facilitate retrieval of data from the sensor 110 and delivery of related information to a user. The receiver 120 can be a single-purpose device created specifically to communicate with the sensor 110. As embodied herein, receiver 120 can include a multi-purpose hardware device — such as a mobile phone, tablet, personal computing device, or other similar computing device capable of communicating with the sensor 110 over a communication link — further configured with a software library or application licensed to a third-party. When executing the software library or application, the multi-purpose device can securely communicate with the sensor 110. As used herein, a data-receiving device or receiver refers equally to a dedicated data-receiving device or a multi-purpose data- receiving device.

[0067] As embodied herein, the sensor 110 can include small, individually-packaged disposable devices with a predetermined active use lifetime (e.g., 1 day, 14 days, 30 days,etc.). Sensors 110 can be applied to the skin of the patient body and remain adhered over the duration of the sensor lifetime. As embodied herein, sensor 110 can be designed to be selectively removed and remain functional when reapplied. The role of the sensor 110 can be defined by the nature of the medical hardware embodied in the sensor 110.

[0068] For the purpose of illustration and not limitation, reference is made to the example embodiment of a sensor 110 for use with the disclosed subject matter as shown in FIG. 1. FIG. 1 illustrates a block diagram of an example sensor 110 according to example embodiments compatible with the embedded systems architecture and communication schemes described herein. As embodied herein, the sensor 110 can include a printed circuit board ("PCB") acting as a backplate for the electronic components of the sensors. Coupled to the PCB is an application-Specific Integrated Circuit ("ASIC") 130 communicatively coupled with a communication module 140, and medical hardware 155 selected for the monitoring function of the sensor 110. The ASIC 130 and communication module 140 can also be coupled to a battery 150 supplying power to the ASIC 130, communication module 140, and other components of the sensor 110 not illustrated. The ASIC 130 and the communication module 140 can be physically separate modules, as illustrated in FIG. 1. Alternatively, the ASIC 130 and the communication module 140 can both be integrated into a single chip.

[0069] As embodied herein, as the sensor 110 is designed to be power-efficient, low- cost, and can be disposable. The ASIC 130 can include on-board non-volatile memory 131. The ASIC can include a reference clock, used for communication and programming, memory management, on-chip timers, etc. The ASIC 130 can receive power from the battery 150, regulated by the power manager 137. Under the conditions described herein, components of the ASIC 130 can receive power from nearby fields via coupling with a communication chipset embedded in the ASIC 130 (e.g., with the NFC radio front end 135). The NFC radio front end 135 can be compliant with relevant power-delivery standards. As described herein, the NFC radio front end 135 can be activated once the battery 150 is connected. Alternatively, the NFC radio front end 135 can be used to activate the sensor 110 and turn on the battery 150. The ASIC 130 can further include a serial-peripheral interface (SPI) 133 and / or analog front end (AFE) 139 for communicating with the other components of the sensor 110. For example, the SPI 133 can be used for communicating with the communication module 140 as described herein. The SPI 133can also be used for testing and for programming the components of the sensor 110 during manufacture. Similarly, the AFE 139 can be used for communication with the medical hardware 155.

[0070] The non-volatile memory 131 can be programmed by the manufacturer of the ASIC 130, by the manufacturer of the sensor 110 (if the two are manufactured by different entities or at different times) or during other configuration processes. The nonvolatile memory 131 of the ASIC 130 can be programmed to include information such as an identifier for the ASIC 130. The identifier can be used to uniquely identify the ASIC 130 for identification and / or tracking purposes. The non-volatile memory 131 of the ASIC 130 can also be programmed with configuration or calibration parameters for use by the sensor 110 and its various components, including the NFC radio 135, power manager 137, analog front-end 139, medical hardware 155, or by the communication module 140, as discussed herein.

[0071] The non-volatile memory 131 can be further programmed to include a manufacturer code as part of, or separate from, the identifier for the ASIC 130, communication module 140, or other components of the sensor 110. As an example, each manufacturer of components that can be used in the sensor 110 can be assigned an internationally-recognized code as designated by a standards-setting organization, such as, by way of example only, the International Organization for Standardization. The manufacturer code can be used to identify the manufacturer of the ASIC 130. As embodied herein, the manufacturer code can be used to verify compatibility with the sensor 110. For example, the sensor 110 can be configured to only be used in conjunction with receivers 120 (or other devices) associated with or produced by a manufacturer from a list of known manufacturers, e.g., a "whitelist", as recognized by the manufacturer code. As another example, the sensor 110 can be configured to refuse operability with receivers 120 associated with or produced by manufacturers on a list of forbidden manufacturers, e.g., a "blacklist". Similarly, the receiver 120 can be configured to only be compatible with sensors 110 associated with or produced by select manufacturers.

[0072] In one embodiment, the determination of whether a device attempting to communicate or operate with the sensor 110 will be recognized by the sensor 110 can be made by the ASIC 130. As described, the list of valid or invalid manufacturer codes can be programmed into the non-volatile memory 131 of the ASIC 130. The ASIC 130 can thencompare its list of manufacturer codes to the manufacturer code of the device attempting to communicate with the sensor 110. Making this determination at the ASIC 130 can be advantageous as the non-volatile memory 131 can be protected from alteration after manufacture of the ASIC 130 and sensor 110 is completed. In another embodiment, the determination of whether to allow communication with a device can be made by the communication module 140. As an example, the communication module 140 can be updated by the provider of the sensor 110 to update a list of valid or invalid manufacturer codes (e.g., during a firmware update process). In such implementations, the list of valid or invalid manufacturer codes is not fixed at the time of manufacture but can be adjusted by the provider of the sensor 110 over time. For example, a new manufacturer can be approved for interoperability, or a previously-approved manufacturer can be blocked.

[0073] The update process, whether through a firmware update or other process for updating data stored by the sensor 110 and specifically the communication module can be performed through communication between the communication module 140 and an update server provided by the provider of the sensor 110 or an authorized representative thereof. The communication module 140 can connect to the update server via any of a variety of network protocols. For example, the communication module 140 can include one or more long-range communication transceivers to allow the communication module 140 to communicate on a wide area network and with the update server. As an example only, the communication module 140 can incorporate one or more broadband cellular network radios (and accompanying chipsets) to communicate using, for example, third- generation (e.g., HSPA, HSPA+), fourth-generation (e.g., Mobile WiMAX, LTE, LTE Advanced Pro), fifth generation (e.g., low-band, mid-band, high-band) standards. The communication module 140 can additionally or alternatively include Wi-Fi radios and chipsets to communicate with the wide area network. Additionally, or alternatively, the update process can be mediated by a second device, such as a mobile phone or personal computing device. The second device can securely receive an update from the update server and deliver the update the sensor 110. Relatedly, the sensor 110 can use the communication capabilities of the second device to connect with the update server.

[0074] As an example only and not by way of limitation, example communication modules 140 of the sensor 110 can include chipsets compatible with a variety ofcommunication protocols, including Bluetooth Low-Energy ("BLE"), Near-Field Communication ("NFC"), similar short-range communication schemes, wireless personal 25 area networks (WPAN) or piconets, wireless body area networks (WBAN), the Zigbee protocol, WiMAX protocols, or other IEEE 802.15 or IEEE 802.11 protocols, or infrared communication protocols according to the Infrared Data Association standards (IrDA), etc. The communication module 140 can transmit and receive data and commands via interaction with a similarly-capable communication module 170 of a receiver 120. As described herein, the communication module 140 can include a microcontroller 143 for executing software operations defined in memory storing software blocks 145. The software 145 can be written to the appropriate memory as a one-time programmable memory. The software 145 can include software directed to an application layer 146 and a link layer 147. The application layer 146 can include application software programmed to the communication module 140 to control functions of the sensor 110 related to medical operations, recording measurements, analyzing measurements, data processing, security applications, anti-fraud applications, error handling, and other customized functions. The link layer 147 can include software programmed to the communication module 140 used to facilitate communication using the chosen communication protocol. As an example, where the communication module 140 includes a BLE chipset, the link layer 147 can include software configured to manage communications using the BLE protocol. The link layer 147 can be preconfigured or updated by the manufacturer of the communication module 140, whereas the application layer 146 can be specially configured or updated by the manufacturer of the sensor 110.

[0075] The memory 141 of the communication module 140 can support the operations of the microcontroller 143. The communication module 140 can further include interfaces (not illustrated) for communicating with the other components of the sensor 110. In some instances, the microcontroller 143 of the communication module 140 can be a general, reprogrammable processor configured to handle more processing-intensive tasks than the ASIC 130.

[0076] As embodied herein, the sensor 110 can be a disposable device with a predetermined life span, and without wide-area network communication capability. As embodied herein, the communication module 140 can provide for communication under battery power. Although this disclosure is described with respect to exampleconfigurations of the sensor 110, other suitable configurations are envisioned. As an example, processing hardware of the sensor 110 can be implemented as another type of special-purpose processor, such as a field programmable gate array (FPGA). As embodied herein, the processing hardware of the sensor 110 (e.g., of the communication module 140) can include a general-purpose processing unit (e.g., a CPU) or another programmable processor that is temporarily configured by software to execute the functions of the sensor 110. More generally, the processing hardware can be implemented using hardware, firmware, software, or a suitable combination of hardware, firmware, and software. For the purpose of illustration and not limitation, the processing hardware of the sensor 110 can be defined by one or more factors including computational capability, power capacity, memory capacity, availability of a network connection, etc.

[0077] As embodied herein, the processing responsibilities of the ASIC 130 and communication module 140 can be divided based on computational complexity and computational resources. The ASIC 130 can be configured to focus on interpreting measurements and other data from the medical hardware 155. For example, the ASIC 130 can be specially configured to interpret the analog signals output by the medical hardware 155 and received by the ASIC 130 through the AFE 139. Through interpretation, the ASIC 130 can create digital measurements (e.g., an output signal) suitable for use in algorithms executed by the communication module 140. The communication module 140 can in turn perform advanced processing on the raw measurement signals received from the ASIC 130. For example, the communication module 140 can analyze the measurement signals to derive analyte levels and identify trends and actionable responses for the patient, which are then transmitted to the receiver 120. In certain embodiments, the ASIC 130 can also be configured to derive analyte levels and identify trends and actionable responses for the patient, before providing the analysis to the communication module 140 to transmit to the receiver 120. In some instances, the measurement signals or digital measurements created by the ASIC 130 are transmitted (via the communication module 140) to another device (e.g., receivers 120, 176, 178, etc.) to enable the other device to derive the analyte levels, identify trends, determine actionable responses, etc.

[0078] The medical hardware 155 can be connected electrically to the PCB via multiple electrical connections, e.g., a working connection (WRK), a reference connection (REF), a counter connection (CTR) (see FIG. 23). In some implementations, the medical hardware 155 includes sensor hardware, such as an analyte sensor. An analyte sensor as embodied herein can incorporate multiple electrodes, and each electrical connection can correspond to one or more of the electrodes (e.g., one electrode may correspond to WRK, another may correspond to REF, and another can correspond to CTR). Voltage (e.g., measurement signals) from these connections can be delivered to the ASIC 130 (e.g., through the analog front end 139). The analyte sensor can generate a current that flows between the electrodes and is dependent on an analyte concentration and temperature. The ambient conditions of the analyte sensor can also change over time which can affect the voltage readings from the medical hardware provided to the ASIC 130. The potential of one or more of the electrical connections (e.g., the counter connection) can be adjusted correspondingly to ensure a relatively constant target voltage over other electrical connections (e.g., the reference connection) for interpretation to determine analyte levels.

[0079] In some implementations, the sensor 110 implements a thermistor 157 to obtain temperature measurements, which may be usable in determining analyte levels based on the measurement signal(s) obtained via the sensor hardware of the medical hardware 155. The thermistor 157 can include one or more thermistors to measure the skin temperature of a patient to which the sensor 110 is attached or other aspects of the operating environment of the sensor 110, and especially the sensor hardware. As embodied herein, user skin measurement can be implemented with a single-element thermistor and a trimmed resistive elements within the ASIC 130. The thermistor can be positioned so that its active element is positioned in close proximity to the sensor element (e.g., an analyte sensor sensing element) and in as close thermal contact with the patient's skin as possible. FIG. 22 illustrates a diagram of the thermistor measurement function 2200. To measure the thermistor temperature, ASIC 130 biases the thermistor element 2210 in series with a trimmed resistive element 2220 and resistive element 2230 included in the ASIC 130. The ASIC 130 measures the voltage across the resistive elements 2220 and 2230. The ASIC 130 can average multiple measurement results depending on a selected sampling frequency. The conversion to temperature can be an iterativecalculation, first calculating the temperature based on the trimmed resistive element value and the Steinhart coefficients of the thermistor. Then a second calculation is performed applying the temperature correction for the resistive element. The calculations can further include device-specific parameters provided with the ASIC 130.

[0080] To perform its medical functionalities, the sensor 110 can further include suitable medical hardware 155 appropriate to its function. As embodied herein, the medical hardware 155 can additionally include, for example, an autoinjector prescribed to a patient for self-administering a drug or other medicament. Accordingly, the medical hardware 155 can include a mechanism that drives a needle or a plunger of a syringe in order to subcutaneously deliver a drug. The syringe can be pre-filled with the drug and can operate in response to a triggering event. For example, the mechanism can drive the needle into the patient and advance the plunger to deliver the drug subcutaneously via the needle.

[0081] As embodied herein, the sensor 110 can be configured as an on-body injector attachable to a patient's body tissue (e.g., skin, organ, muscle, etc.) and capable of automatically delivering a subcutaneous injection of a fixed or patient-selected dose of a drug over a controlled or selected period of time. In such embodiments, the medical hardware 155 or low-power medical device can include, for example, an adhesive or other means for temporarily attaching the medical hardware 155 to the patient's body tissue, a primary container for storing a drug or medicament, a drive mechanism configured to drive or permit the release of a plunger to discharge the drug from the primary container, a trocar (e.g., a solid core needle), a flexible cannula disposed around the trocar, an insertion mechanism configured to insert the trocar and / or flexible cannula into the patient and optionally retract the trocar leaving the flexible cannula in the patient, a fluid pathway connector configured to establish fluid communication between the primary container and the flexible cannula upon device activation, and / or an actuator (e.g., a user displaceable button) configured to activate the device. As embodied herein, the on-body injector can be pre-filled and / or pre-loaded.

[0082] In addition to mechanical components, the medical hardware 155 can include electric and / or electronic components. For example, an electronic switch can be coupled to the mechanism. The sensor 110 can establish an authenticated communication, receive an encrypted signal, decrypt the signal using the techniques of this disclosure,determine that the signal includes a command to operate the switch, and cause the switch to drive the needle. Thus, the system 100 embodied herein can be configured to perform a medical function using the medical hardware 155 in response to a remote command.

[0083] As embodied herein, the medical hardware 155 can include a travel sensor and an analog-to-digital converter (ADC) to generate a digital signal indicative of the distance traveled by the needle or plunger. Upon delivering the medicament, the sensor 110 can obtain a reading from the travel sensor, encrypt the reading, and securely report the reading to a peer device (e.g., receiver 120). Additionally, or alternatively, the sensor 110 can report other measurements or parameters, such as a time at which the medicament was delivered, volume of medicament delivered, any issues encountered while delivering the medicament, etc.

[0084] The medical hardware 155 can be configured to implement any suitable combination of one or more medical functions and can include one or more sensing components. Such sensing components can be configured to detect an operational state of the sensor 110 (e.g., unpackaged / ready for administration, sterile barrier removal, contact with patient's body tissue, cannula and / or needle insertion, drug delivery initiation, actuator or button displacement, drug delivery completion, plunger position, fluid pathway occlusion, etc.), a condition of the sensor 110 or drug contained therein (e.g., temperature, shock or vibration exposure, light exposure, drug color, drug turbidity, drug viscosity, geographic location, spatial orientation, temporal information, ambient air pressure, etc.), and / or physiological information about the patient (e.g., body temperature, blood pressure, pulse or heart rate, glucose levels, physical activity or movement, fingerprint detection, etc.).

[0085] In some implementations, the sensor 110 comprises part of a sensor assembly that includes components that can facilitate affixation of the sensor 110 to a subject. FIG. 36 is a perspective view of an on-body unit 3602, and FIG. 37 provides a partial cross- sectional view thereof. The on-body unit 3602 includes a sensor 3604 and a sensor control unit 3606, which may comprise components of or perform functionality described herein in association with the sensor 110 of FIG. 1. The sensor 3604 may comprise an analyte sensor that may be used to monitor levels of a wide variety of analytes. Analytes that may be monitored include, for example, acetylcholine, amylase, bilirubin,cholesterol, chorionic gonadotropin, creatine kinase (e.g., CK-MB), creatine, DNA, fructosamine, glucose, glutamine, growth hormones, hormones, ketones, lactate, peroxide, prostate-specific antigen, prothrombin, RNA, thyroid stimulating hormone, and troponin. The concentration of drugs, such as, for example, antibiotics (e.g., gentamicin, vancomycin, and the like), digitoxin, digoxin, drugs of abuse, theophylline, and warfarin, may also be monitored. One or more analytes may be monitored by a given sensor. In some embodiments, more than one sensor, each monitoring one or more analytes, may be provided.

[0086] In one embodiment of the present disclosure, sensor 3604 is physically positioned in or on the body of a user whose analyte level is being monitored. In some implementations, at least a portion of the sensor 3604 is positioned under the skin of the user, as described below. Sensor 3604 may be configured to continuously sample the analyte level of the user and convert the sampled analyte level, e.g., glucose concentration into a corresponding data signal, e.g., a current or voltage, for input into sensor control unit electronics. Alternatively, sensor 3604 may be configured to sample analyte levels on demand. The sensor control unit electronics may amplify, filter, or otherwise process the signal provided by the sensor. The sensor may take on a number of forms. For example, the sensor may include a flexible or rigid substrate. In some embodiments, the sensor may be a wire. In some embodiments, the sensor may include two or three or more electrodes arranged on one or more wires.

[0087] In some embodiments, sensor 3604 includes a substrate which is a dielectric, e.g., a polymer or plastic material, such as polyester or polyamide. In some embodiments, the sensor is constructed so that a portion is positionable beneath skin and a portion is above skin. Accordingly, sensor 3604 includes an insertion portion 3704 and a contact portion 3702 (see FIG. 37). The contact portion 3702 can include several conductive contacts for connection to other electronics (e.g., at the sensor control unit 3606).

[0088] In the example of FIG. 36, the sensor control unit 3606 has a substantially circular configuration with a reduced height (i.e., "Z"-dimension) to provide a low profile when sitting on the skin of the subject. In some embodiments, the height is about 25 mm or less (e.g., about 4 mm, about 5 mm, about 10 mm, or about 15 mm). The height may be greater than about 3 mm. In certain embodiments, the sensor control unit 3606 may have a variable height. In FIG. 36, the sensor control unit 3606, including its associatedelectronics 3608 (e.g., on-body electronics, which may be coupled to the sensor 3604 and which may comprise aspects of communication module 140, ASIC 130, battery 150, medical hardware 155, thermistor 157, etc.), are housed in a sensor housing 3610 (e.g., an on-body electronics unit housing, which may be detachably engageable with an inserter).

[0089] In some embodiments, sensor 3604 is disposed within the sensor control unit 3606, (e.g., in a bent configuration). The contact portion 3702 of sensor 3604 may be oriented in a substantially horizontal configuration (generally parallel to the bottom of the inserter and parallel to the skin surface after deployment) and secured to a printed circuit board of the sensor control unit 3606. The insertion portion 3704 of the sensor 3604 extends in a substantially downwardly vertical orientation for placement in the skin of the subject (generally perpendicular to the bottom plane of the inserter and the skin surface after deployment). It is understood that sensor 3604 may be disposed in other configurations (e.g., in an entirely substantially vertical configuration, etc.). As a further example, the insertion portion 3704 may be disposed at an oblique angle, e.g., between about 0° and about 90° with respect to the skin surface.

[0090] A sensor assembly may comprise an inserter to facilitate affixation of the on-body unit 3602 to a subject and / or insertion of the insertion portion 3704 of the sensor 3604 into the subject. An inserter 4400 and components thereof are shown in FIGS. 38-44. In the illustrated embodiments, an inserter 4400 includes a handle 3802 and a removable distal cap 3902. The cap 3902 may maintain a sterile, contaminant-free environment for the medical device and sharp housed therein. As illustrated in FIGS. 38-40, distal cap 3902 is secured to handle 3802 by use of one or more mating members (e.g., threads 3804 and 3904, or hooks, tape, and the like). Inserter 4400 includes a base 4102 which defines a distal, substantially planar rim 4104 or surface for placement on the skin of a subject, and in other embodiments may be a curved or inclined surface (e.g., a concave or convex surface). Inserter 4400 may be utilized to advance a medical device into the skin of the subject (e.g., on-body unit 3602). In some embodiments, handle 3802 is advanced relative to base 4102 in order to advance the medical device into the skin of the patient, as will be described in greater detail herein.

[0091] As illustrated in FIG. 38, handle 3802 includes a contact surface 3806 for contact by a user to insert and install the sensor housing 3610 and sensor 3604. Threads 3804 areprovided on handle 3802 for attachment to cap 3902 via threads 3904 (as illustrated in FIGS. 39-40). Cap 3902 can include an upwardly extending boss 3908 to assist positioning of the sharp 4302. The distal portion of cap 3902 includes a recess 4002 for retaining a desiccant 4408 therein. In some embodiments, a silica gel or molecular sieves may be used. Such material can be either in granular form (pellets) or pressed into tablets. In some embodiments, silica gel tablets are used.

[0092] Cap 3902 is provided with one or more apertures 4004, which allows for passage of air to the desiccant 4408 to remove moisture from the interior of the inserter 4400. Cap 3902 includes an annular ridge 3906 which engages the distal edge portion 3808 of handle 3802. In some embodiments, annular ridge 3906 prevents distal movement of handle 3802 (as well as sharp 4302) when cap 3902 is attached to handle 3802.

[0093] Base 4102, as illustrated in FIG. 41, includes a distal sheath portion 4110, which shields sharp 4302 prior to deployment, and a distal rim 4104 having a substantially planar surface configuration to rest on the subject's skin. Base 4102 also includes side walls 4108, which along with inner rail 4402 defines a recess for retraction spring 4406. Base 4102 can provide a spring floor.

[0094] Support member or shuttle 4202, as illustrated in FIGS. 42-43, supports needle hub 4304, from which sharp 4302 extends longitudinally within the inserter 4400. In some embodiments, the sharp is supported at an oblique angle, e.g., between about 0° and about 90° with respect to the skin surface. Needle hub 4304 can be secured to shuttle 4202 via an interlocking O-ring configuration, adhesive, or other techniques known in the art. In some embodiments, sharp 4302 is a solid needle. In some embodiments, sharp 4302 is provided with a substantially cylindrical configuration defining an interior bore, e.g., a rigid cannula or a hypodermic-style needle.

[0095] With continued reference to FIGS. 42 and 43, shuttle 4202 can include wings 4204 and resilient distally-extending fingers 4206.

[0096] Inserter 4400 is illustrated in section in FIG. 44 prior to use in a sensor predeployment position. Cap 3902 is attached to the distal portion of inserter 4400, via interengagement of threads 3804 and 3904.

[0097] As illustrated in FIG. 44, the inserter4400 includes an initial configuration in which the handle 3802 is disposed in a proximal position with respect to the base 4102. In such a configuration, the sharp 4302 is disposed in a configuration spaced apart from anaperture of the adhesive layer 3706. The handle 3802 may be depressed downward against the bias of the spring 4406, causing the inner rail 4402 to move downwardly with the carriage 4404 and the sensor housing 3610 of the on-body unit 3602. The shuttle 4202 supports the needle hub 4304 and, correspondingly, the sharp 4302. As the sharp 4302 is advanced, it carries the sensor insertion portion 3704 of the sensor 3604 into the subcutaneous portion of the subject's skin and into contact with the interstitial fluid. As carriage 4404 reaches a distal position, the distal surface of the sensor housing 3610 engages the upper surface of adhesive layer 3706, thereby becoming adhered to the skin surface of the subject. The fingers 4206 of the shuttle 4202 may then be pivoted or bent inwards by contact with the flanges 4106 of the base 4102. Such pivoting of the fingers 4206 causes the fingers 4206 of the shuttle 4202 to become disengaged from the distal edge of the inner rail 4402, which can permit the spring 4406 to expand, thereby advancing the shuttle 4202 to a proximal position, and withdrawing the sharp 4302 from the sensor 3604 and the skin of the subject, while leaving the sensor 3604 in the skin.

[0098] Attention is again directed to FIG. 1, which further illustrates an architectural diagram of an example embodiment of a receiver 120 for use with the disclosed subject matter. In some instances, the receiver 120 can include a small-form factor device. The receiver 120 can optionally not be as memory- or processing-power constrained as the sensor 110, and as embodied herein, the receiver 120 can include sufficient memory for operational software storage and data storage, and sufficient RAM for software execution to communicate with sensor 110 as described herein. The receiver 120 can include a CPU 160, memory 161, and storage 163, communicatively coupled with a communication module 170. Power for the components of the receiver 120 can be delivered by a power module 167, which as embodied herein can include a rechargeable battery, allowing for sustained operations and continued use. The receiver 120 may take on various forms in various instances, such as a mobile electronic device (e.g., a smartphone, laptop, tablet, desktop computer, head-mounted display, smartwatch, other wearable devices, etc.). In some instances, the receiver 120 comprises an insulin pump or other medical or therapeutic delivery device.

[0099] The receiver 120 can be configured to wirelessly couple with, or scan the sensor 110 and retrieve data, e.g., sensitive medical data, therefrom. As embodied herein, the receiver 120 can optionally include medical hardware 165 similar to, or expanded from,the medical hardware 155 of the sensor 110. As an example only, and not by way of limitation, in an embodiment in which the medical hardware 155 of the sensor 110 is configured for continuous glucose monitoring, the medical hardware 165 of the receiver 120 can be configured with a blood glucose meter, compatible for use with blood glucose test strips, thus expanding on the blood glucose monitoring of the system 100. In some embodiments, the receiver 120 does not include additional medical hardware 165.

[0100] As embodied herein, the receiver 120 can be configured to operate, with respect to the sensor 110 as described herein, as an NFC scanner and a BLE endpoint via specific modules of the communication module 170. As embodied herein, the receiver 120 can be configured for communication with via a Universal Serial Bus (USB) of the communication module 170. As embodied herein, the onboard storage 163 of the receiver 120 can be capable of storing medical data received from the sensor 110 over an extended period of time. Further, the receiver 120 can be configured to communicate with a user computing device or remote cloud server via a wide area network.

[0101] Upon successful activation of the sensor 110 by a receiver 120, the sensor 110 can be configured to collect medical data and makes that data available to the receiver 120. The receiver 120 can act as a data collector. As an example, the receiver can pair with the sensor 110 over an NFC interface, providing short-range power to the sensor 110 and communicatively coupling with the sensor 110 over said NFC interface. Alternatively, the receiver 120 can communicatively couple with the sensor 110 over a medium-range interface, such as a Bluetooth or Bluetooth Low Energy ("BLE") interface or any suitable interfaces compatible with the communication protocols implemented by the sensor 110, as described herein. The sensor 110 can transmit medical data used for medical monitoring and / or alarm functions.

[0102] As used throughout this disclosure, Bluetooth Low Energy refers to a mediumrange communication protocol configured to make pairing of Bluetooth devices simple for end users. As described herein, the use of BLE on the sensor 110 can optionally not rely on standard BLE implementation of Bluetooth for security but can instead use application layer encryption using one or more block ciphers to establish mutual authentication and encryption. The use of a non-standard encryption design implemented in the application layer has several benefits. One benefit of this approach is that the user can complete the pairing of the sensor 110 and receiver 120 with only anNFC scan and without involving the user providing additional input, such as entering a security pin or confirming BLE pairing between the data receiving device and the sensor 110. Another benefit is that this approach mitigates the potential to allow devices that are not in the immediate proximity of the sensor 110 to inadvertently or intentionally pair, at least in part because the information used to support the pairing process is shared via a back-up short-range communication link (e.g., NFC) over a short range instead of overthe longer-range BLE channel. Furthermore, as BLE pairing and bonding schemes are not involved, pairing of the sensor 110 can avoid implementation issues by chip vendors or vulnerabilities in the BLE specification.

[0103] As the data collected by the sensor 110 and exchanged between the sensor 110 and data receiving device pertain to medical information about a user, the data is highly sensitive and can be beneficial to be protected. Medical data associated with a patient is sensitive data at least in part because this information can be used for a variety of purposes, including for health monitoring and medication dosing decisions. As embodied herein, encryption and authentication can be used as two of the primary technical controls for providing protective features. As embodied herein, the sensor 110 and receiver 120 can be configured compliant with a security interface designed to protect the Confidentiality, Integrity and Availability ("CIA") of this communication and associated data. To address these CIA concerns, security functions can be incorporated into the design of the hardware and software.

[0104] To facilitate the confidentiality of data, communication connections between the sensor 110 and receiver 120 can be mutually authenticated prior to transmitting sensitive data by either device. Communication connections can be encrypted using a deviceunique or session-unique encryption key. To guarantee the integrity of data, to ensure that patient data is unmodified, encrypted communications between the sensor 110 and receiver 120 can be verified with transmission integrity checks built into the communications. As embodied herein, session key information, which can be used to encrypt the communication, can be exchanged between two devices after the devices have each been authenticated.

[0105] As embodied herein, the sensor 110 and receiver 120 can each employ a variety of security practices to ensure the confidentiality of data exchanged over communication sessions and facilitate the relevant devices to find and establish connections with trustedendpoints. As an example, the sensor 110 can configure the communication module 140 to use preconfigured advertising parameters with a public device address. The communication module can send connectable undirected advertising events and process scans and connection requests from all receivers 120. The sensor 110 can request the communication module 140 to start advertising immediately after it is activated. The communication module 140 can continue to advertise until it receives and accepts a connection request packet. Once connected to a receiver 120, the communication module 140 can be no longer discoverable. No other device can connect to it. The communication module 140 can also stop advertising if no connection request packet is received within a predefined amount of time (e.g., two second, four seconds). The sensor 110 can stop advertising by configuring the communication module to non-discoverable mode. Once in the non-discoverable mode, the communication module 140 stops sending advertising events, and no device can discover or connect to it. To restart advertising, the sensor 110 requests the communication module 140 to advertise on every other instance when a measurement is logged. Therefore, if the sensor 110 is not connected to a receiver 120, it can restart advertising every two minutes. When a sensor 110 is both activated and is in a state in which no measurement data is logged, the sensor 110 can use a timer to continue the same advertising schedule.

[0106] These characteristics safeguard against specific denial of service attacks, and in particular against denial-of-service attacks on a BLE interface. As embodied herein, the identifiers used to connect to the sensor 110 can be mutable to reduce the ability to track a single sensor 110 as it connects to one or more data receiving devices. Connection identifiers for the sensor 110 or data receiving device can include, as an example only, a unique or semi-unique device identifier, a media access control address for the communication module of the device, a device address configured for the particular communication protocol (e.g., a BLUETOOTH address, etc.), internet protocol address, an identifier assigned to the device by the low-power medical monitoring system, a universally-agreed identifier for the type of device that is broadcasting, etc. The sensor 110 can change identifiers between sensor 110 activation and pairing with the first receiver 120. If the sensor 110 disconnects from the first receiver 120 during its active use timeline, the sensor 110 can change the connection identifier on disconnection or on receiving a request for a new connection with a second receiver 120.

[0107] As embodied herein, the sensor can support establishing long-term connection pairs by storing encryption and authentication keys associated with data receiving devices or support a data receiving device storing an encryption and authentication key for the sensor 110 for a prolonged period of time. For example, the sensor 110 or data receiving device can associate a connection identifier for the other party to the exchange in association with the encryption and authentication keys used by the other party. In so doing, the sensor 110 can establish connections with a data receiving device more quickly, at least in part because sensor 110 can avoid establishing a new authentication pairing with that data receiving device and can proceed directly to exchanging information via the encrypted communication protocols described herein. After a connection is successfully established, the two devices can refrain from broadcasting connection identifiers and other information to establish a new connection and can communicate using an agreed channel-hopping scheme to reduce the opportunity for third-parties to listen to the communication. As another example, the sensor 110 can be configured to scan available connection points and prefer connections with those devices to which it has already connected, such as those devices which the sensor 110 has previously established an authenticated exchange. Scanning for and connecting to known devices can reduce the opportunity for malicious third-parties to intersect an authentication exchange when other trusted data receiving devices are within communication range.

[0108] In some implementations, the receiver 120 is part of a set of receivers 172 (or a network of receivers 172). In the example of FIG. 1, the set of receivers 172 includes receiver 120, additional receiver 176, and additional receiver 178. The additional receivers 176 may comprise at least some components similar to those described herein in association with receiver 120 (one will appreciate that the additional receivers 176 and / or 178 may comprise additional or alternative components and / or may omit some components). Different receivers of the set of receivers 172 may take on different forms. For instance, one receiver of the set of receivers 172 may comprise a user's mobile electronic device (e.g., smartphone), whereas another receiver of the set of receivers 172 may comprise an insulin pump, standalone reader or other device. The ellipsis in the set of receivers 172 of FIG. 1 indicates that the set of receivers 172 may comprise any number of receivers (e.g., one or more receivers).

[0109] FIG. 1 furthermore depicts that the sensor 110 may engage in communications 174 with any sensors of the set of receivers 172 (e.g., via communication modules 140 and 170, ASIC 130, etc.). FIG. 1 also depicts that, in some instances, receivers of the set of receivers 172 may engage in communications 180 with one another. Communications 174 and / or 180 may comprise connection requests, data transmissions (e.g., security / authentication data), commands (e.g., switch receiver commands), and / or others as described herein. Communications 174 and / or 180 may utilize various types or combinations of communication channels, such as BLE channels, NFC channels, wide- area network channels, peer-to-peer connection channels (e.g., peer-to-peer Wi-Fi, Zigbee, loT (internet of things) connections, etc.), combinations thereof, and / or others. Different communication channels are represented in FIG. 1 with different line types representing the different communications 174, 180. For instance, FIG. 1 shows a solid lined communication 174, a dash-dash lined communication 174 and 180, and a dash- dot-dash lined communication 180, indicating an example that includes communication channels. One will appreciate, in view of the present disclosure, that any number of communication channels may be used.

[0110] In some instances, a receiver (e.g., receiver 120) of the set of receivers 172 may leverage its communications 174 with the sensor 110 and its communications to extend or establish secure connectivity between the sensor 110 and other receivers (e.g., additional receivers 176 and / or 178) of the set of receivers 172. Such functionality may be advantageous when some receivers of the set of receivers 172 lack the ability to communicate under certain communication channels that are used to securely connect to the sensor 110. For instance, the sensor 110 may be configured to send security data (e.g., a BLE pin) to receivers via a first communication channel (e.g., NFC) to establish secure connections with the receivers, after which the sensor 110 and the receiver may transmit data over a second communication channel (e.g., BLE). However, a receiver of the set of receivers 172 (e.g., an insulin pump), such as additional receiver 176, may lack the ability and / or hardware to communicate over the first communication channel (e.g., NFC). As disclosed herein, communication capabilities of other receivers of the set of receivers 172 may be leveraged to establish secure connections between the sensor 110 and the additional receiver 176 that may lack the ability, of itself, to communicate over the first communication channel.

[0111] In one illustrative example, receiver 120 may send a connection request (e.g., a communication 174) to sensor 110 via a first communication channel. The connection request may correspond to various types of requests described herein. In some implementations, the first communication channel is an NFC channel. In some instances, prior to sending the connection request, receiver 120 is already securely connected to the sensor 110 (e.g., via authentication and / or security communications / processes described herein). For instance, the receiver 120 and the sensor 110 may have an authenticated connection in which the sensor 110 sends (periodically and / or on demand) medical data, measurement data, and / or other data to the receiver 120 (e.g., glucose monitoring data) via a second communication channel that is different from the first communication channel (e.g., different from the NFC channel). In some instances, the second communication channel is a BLE channel.

[0112] The connection request sent to the sensor 110 may be regarded as being made by the receiver 120 on behalf of another receiver of the set of receivers 172, such as additional receiver 176. As noted above, in some instances, the additional receiver 176 may lack an NFC interface (e.g., the additional receiver 176 may comprise an insulin pump that lacks an NFC interface). However, the additional receiver 176 may be configured to communicate in compliance with other communication channels, such as the second communication channel (e.g., the BLE channel) and / or others (e.g., peer-to-peer channels, wide-area network channels). In some instances, the receiver 120 sends the connection request to the sensor 110 (e.g., via the first or NFC communication channel) in response to an initial connection request sent by the additional receiver 176 to the receiver 120 (e.g., a communication 180). The initial connection request may be sent via a communication channel that is different from the first communication channel (e.g., a third communication channel, which may comprise any non-NFC communication channel, such as a BLE channel, other peer-to-peer channel, a channel that utilizes a wide- area network, etc.). In some instances, the initial connection request sent by the additional receiver 176 to the receiver 120 includes one or more of authentication data, manufacturer codes, security data, certificate / credential data, and / or other information associated with the additional receiver 176, which may be included in the connection request sent by the receiver 120 to the sensor 110.

[0113] After receiving the connection request from the receiver 120, the sensor 110 may send security data (e.g., another communication 174) to the receiver 120. In some implementations, the security data can be used to facilitate a secure, authenticated, and / or trusted connection between the sensor 110 and one or more receivers over the second communication channel (e.g., the BLE channel). In some instances, the security data includes a connection identifier associated with the sensor 110 (e.g., as described herein). The connection identifier may comprise a BLE pin or address information that enables one or more receivers to receive medical data transmitted by the sensor 110 over the BLE channel. The security data sent from the sensor 110 to the receiver 120 may additionally or alternatively comprise certificate data, one or more encryption keys (e.g., public / private key pairs, signing keys, etc.), credentials, and / or other information.

[0114] The receiver 120 may receive the security data from the sensor 110, and the security data may be used to facilitate or establish a secure connection between the additional receiver 176 and the sensor 110. For instance, the receiver 120 may convey the security data to the additional receiver 176 using a communication channel available to the additional receiver 176 (e.g., a non-NFC channel, such as a third communication channel which may include peer-to-peer connection channels, wide-area network channels, BLE, etc.). With the security data, the additional receiver 176 may proceed to establish a secure connection with the sensor 110 over a communication channel that is available to both the receiver 176 and the sensor 110 (e.g., a second communication channel, which may comprise a BLE channel). The additional receiver 176 and the sensor 110 may utilize authentication and / or security communications / processes described herein to establish the secure connection. The secure connection between the additional receiver 176 and the sensor 110 may enable the communication of medical data, measurement data, and / or other data to the additional receiver 176 (e.g., glucose monitoring data) via the communication channel that is available to both the receiver 176 and the sensor 110.

[0115] In one example, when the additional receiver 176 comprises an insulin pump that lacks an NFC interface, the additional receiver 176 may utilize the security data received from the receiver 120 (which was sent to the receiver 120 by the sensor 110) to establish a closed-loop BLE connection with the sensor 110. The insulin pump may then utilize glucose monitoring data received from the sensor 110 over the BLE connection tomanage insulin output to the subject. In this regard, a secure BLE connection may be established between the additional receiver 176 and the sensor 110 without utilizing NFC communications directly between the additional receiver 176 and the sensor 110 by utilizing (i) NFC communications between the receiver 120 and the sensor 110 (e.g., communications 174), (ii) peer-to-peer communications between the receiver 120 and the additional receiver 176 (e.g., communications 180), and (iii) BLE communications between the additional receiver 176 and the sensor 110 (e.g., communications 174).

[0116] The set of receivers 172 that is securely connected to the sensor 110 may be selectively modified or changed in various ways. In some instances, this is accomplished by a switch receiver command that is sent to the sensor 110 by a receiver. A receiver may send a switch receiver command to the sensor 110 to cause a new set of receivers to become securely connected to the sensor 110. The switch receiver command may additionally cause an initial set of receivers that was initially securely connected to the sensor 110 to disconnect from the sensor 110 (e.g., lose the ability to receive data from the sensor 110).

[0117] The switch receiver command may be sent to the sensor 110 by a receiver in the initial set of receivers, a receiver in the new set of receivers, a receiver in both the initial set of receivers and the new set of receivers, or a receiver in neither the initial set of receivers nor the new set of receivers. The receiver that sends the switch receiver command to the sensor 110 may be regarded as the "sending receiver". In some instances, such as where the sending receiver that sends the switch receiver command to the sensor 110 is not in the initial set of receivers, the sending receiver may receive an initial switch receiver request from a receiver that is included in the initial set of receivers. In some implementations, the initial switch receiver request is sent to the sending receiver via a non-NFC communication channel (e.g., a third communication channel, which may comprise any non-NFC communication channel, such as a BLE channel, other peer-to-peer channel, a channel that utilizes a wide-area network, etc.).

[0118] One will appreciate, in view of the present disclosure, that the initial switch receiver request may be sent to the sending receiver by operation of a device that is not itself a receiver. For instance, a user may interact with a user account or web service associated with a sensor or receiver (e.g., a subject-specific user account) and may triggeran initial switch receiver request to be sent to the sending receiver over a wide-area network.

[0119] The initial switch receiver request may include authentication data (e.g., an initial connection identifier or other information associated with the secure connection between the sensor 110 and any receiver(s) of the initial set of receivers), and the authentication data may be included in the switch receiver command sent by the sending receiver to the sensor 110 to indicate to the sensor 110 that the sending receiver is an authenticated or trusted receiver.

[0120] By way of illustrative example, an initial set of receivers that is securely connected to the sensor 110 comprises additional receiver 176, and a new set of receivers that replaces the initial set of receivers comprises receiver 120 and additional receiver 178, while omitting additional receiver 176. In the illustrative example, receiver 120 is the sending receiver. Continuing with this illustrative example, additional receiver 176 may send an initial switch receiver request to receiver 120 (e.g., a communication 180). The initial switch receiver request may be sent by a non-NFC communication channel. The initial switch receiver request may comprise authentication data.

[0121] In response to the initial switch receiver request, receiver 120 sends a switch receiver command to sensor 110 over a first communication channel (e.g., an NFC communication channel). When processed by the sensor 110, the switch receiver command causes the sensor 110 to generate a new connection identifier to replace an initial connection identifier (e.g., an initial connection identifier used to establish the initial connection(s) with the initial set of receivers). The new connection identifier may comprise a BLE pin or address information that enables one or more receivers to receive medical data transmitted by the sensor 110 over the BLE channel. The generation of the new connection identifier may cause the sensor 110 to disconnect from the initial set of receivers (i.e., additional receiver 176 in the present example), such that the initial set of receivers becomes disabled from receiving medical data and / or other communications from the sensor 110 via a second communication channel (e.g., a BLE channel).

[0122] The new connection identifier generated by the sensor 110 in response to the switch receiver command may be sent to the receiver 120 over the first communication channel (e.g., the NFC channel). In some instances, additional information is sent from the sensor 110 to the receiver 120, such as certificate data, one or more encryption keys(e.g., public / private key pairs, signing keys, etc.), credentials, and / or other information. If the sending receiver (e.g., receiver 120 in the present example) is part of the new set of receivers, the sending receiver utilizes the new connection identifier to securely connect to the sensor 110 (e.g., utilizing authentication and / or security communications / processes described herein) over the second communication channel (e.g., the BLE channel), which may enable the sending receiver to receive medical data and / or other data packets from the sensor 110.

[0123] In some instances, when one or more additional or alternative receivers are included in the new set of receivers (e.g., additional receiver 178 in the present example), the sending receiver conveys the new connection identifier (and / or other security information) to other receiver(s) over a non-NFC communication channel (e.g., a third communication channel, which may comprise any non-NFC communication channel, such as a BLE channel, other peer-to-peer channel, a channel that utilizes a wide-area network, etc.). The other receiver(s) may then be enabled to securely connect to the sensor 110 (e.g., utilizing authentication and / or security communications / processes described herein) over the second communication channel (e.g., the BLE channel), which may enable the other receiver(s) of the new set of receivers to receive medical data and / or other data packets from the sensor 110.

[0124] For the purpose of illustration and not limitation, reference is made to the example embodiment of the software 145 configured for operation by the communication module 140 as shown in FIG. 2. FIG. 2 illustrates an example hierarchical organization of the software blocks 145 described herein with respect to example embodiments. As embodied herein, all the software blocks can be installed on and run on the communication module 140 (e.g., through the microcontroller 143) alone, on the ASIC 130 alone, and / or can be allocated between the communication module 140 and ASIC 130.

[0125] As embodied herein, the software blocks are installed on the communication module 140, and the ASIC 130 is configured without an embedded processor and without software or reprogrammable logic. As such, by installing and executing the software blocks on the communication module 140, the sensor 110 can leverage the processing power of communication module 140 to reduce the cost of the ASIC 130. The complexity of a suitable ASIC 130 can be reduced such that the ASIC 130 is configured to performoperations designated for it and no more. The footprint of the ASIC 130 within the sensor 110 can also be reduced based on the limited complexity and functionality. Additionally, because the ASIC 130 does not necessarily need to be a general-purpose processor, the efficiency of the ASIC 130, and the sensor 110 overall, can be improved.

[0126] Additionally, or alternatively, one or more software blocks can be installed on or otherwise implemented by the ASIC 130 (not illustrated), such that the ASIC 130 can be configured to have an embedded processor and reprogrammable logic and memory. As such, by installing and executing at least some of the software blocks on the ASIC 130 (e.g., in addition to installing some software blocks on the communication module 140), the sensor 110 can leverage the added flexibility of the programmable ASIC 130 and communication module 140 to extend the usefulness of the sensor 110 at least in part because the ASIC 130 will not need to be replaced to add functionality to the ASIC 130. For example, the ASIC 130 can be updated through firmware or software updates (e g., using a process similar to that described herein for updating the communication module 140). Additionally, the ASIC 130 in these embodiments can include a processor configured to perform more complex analyte detection and processing algorithms, and the sensor 110 can use the combined processing capabilities of the ASIC 130 and communication module 140.

[0127] The overall architecture of the software blocks 145 is shown in FIG. 2. The blocks below the dotted line designated SDK 290 exist in read-only memory and are stereotyped as such. All other software blocks, which can be written by the manufacturer of the sensor 110, are loaded into one-time programmable (OTP) memory of the communication module 140.

[0128] The life manager software block 205 can include software functions to manage the overall life operations of the sensor 110. The software functions can include functions to update counter for the active operation time of the sensor 110, manage sensor activation, insertion detection, update the sensor state, and update the sensor status. The data processing software block 210 can include software functions to manage the data processing aspects of the sensor 110. In particular, the communication module 140 handles the bulk of the data processing of the sensor, offloading much of the data processing requirements of the sensor. The software functions can include functions to process raw data after posting, store historical data, and send current measurement datato an authenticated receiving device. The NFC manager 215 can include software functions to hand operations related to sending and receiving NFC communications (e.g., through the ASIC 130). The software functions can include functions to send data to the ASIC NFC radio 135, receive data from ASIC NFC radio 135, and handle received commands.

[0129] The persistent memory manager 220 can include software functions to manage the storage of memory in the memory 141 of the communication module 140. For example, the persistent memory 141 can store diagnostic data relating to the sensor 110 as well as historical data of measurements recorded by the medical hardware 155, interpreted by the ASIC 130, and sent to the communication module 140. The software functions can include functions relating to factory configuration of the sensor 110, historical measurement data, sensor event logging, recording sensor state data, managing RAM used by the dynamic algorithm, manage access to and storage on various memory hardware including static and dynamic persistent RAM, dynamic system RAM, managing access to the one-time programmable memory, and providing for access to the persistent memory through an API. The error handler 225 can include software functions, described in detail herein, to manage accounting for errors detected in the performance by the sensor 110 (e.g., while recording measurements). The firmware update software block 230 can include software functions to enable remote updating and upgrading of the firmware of the sensor 110.

[0130] The security software block 235 can include software functions to relating to the encryption and decryption of sensitive data stored by the communication module 140, encryption and decryption of communications to and from the sensor 110 (e.g., with a receiver 120), and authentication of devices in communication. The security software block 235 can also include functions relating to management of secure and public keys used by the sensor 110. The algorithm software block 240 can include software functions to process and interpret the raw measurement data reported by the medical hardware 155 via the ASIC 130. The software functions can include functions to process fast data (e.g., instantaneous measurements) and slow data (e.g., multiple measurement trends), data quality accessors, calculate current measurement results (e.g., instantaneous glucose measurements), calculate historical measurement results (e.g., historical glucose trends). The measurement software block 245 can include software functions to directlymanage the medical hardware 155. The software functions can include a function to initiate and terminate measurement and configure the analog front end 139 interfacing with the medical hardware 155. The stability test software block 250 can include software functions used to perform sensor testing during or after manufacture.

[0131] The communication module 140 can include one or more medium-range communication radios 148 (e.g., with a range longer than the NFC radio 135 of the ASIC 130). As an example, the communication module 140 can include a Bluetooth radio or Bluetooth Low Energy (BLE) radio. The software blocks 145 can include software to manage the communication radios. As an example, the software blocks 145 can include a BLE manager 255. The manager 255 can include software functions relating to maintenance of the BLE radio, such as BLE configuration, sending to a receiver 120, receiving data from a receiver 120, receiving commands from the receiver 120 (e.g., shutdown) and handling advertisements by which the communication module attempts to identify devices with which the communication module 140 can attempt to establish connections. In particular, the parameters relevant to BLE connections can include transmitter power, connection interval, slave latency, and supervision timeout. The transmitter power parameter can be controlled, as embodied herein with respect to FIG. 19. The sensor 110 can use a BLE connection parameter update procedure to request a receiver 120 to use a set of preferred connection parameters. After a receiver 120 completes an authentication process, the sensor 110 can set its preferred parameters to request for an update to the preferred connection interval, latency, and supervision timeout. This update procedure can reduce power consumption by maximizing the time the radio is in low power mode while maintaining the connection with a receiver 120.

[0132] Similarly, the software blocks 145 can include a BLE services software block 260 with software functions to provide interfaces to make the BLE radio available to the computing hardware of the communication module 140. These software functions can include a BLE logical interface and interface parser. BLE services offered by the communication module can include the generic access profile service, the generic attribute service, generic access service, device information service, data transmission services, and security services. The data transmission service can be a primary service used for transmitting data such as sensor control data, sensor status data, medical measurement data (historical and current), and event log data. The sensor status datacan include error data, current time active, and software state. As embodied herein, the sensor 110 can be configured to send sensor status data to a connected receiver 120 on initial authenticated connection to the receiver 120, when the sensor status changes, or upon request from the receiver 120. The medical measurement data can include information such as current and historical raw measurement values (e.g., blood glucose, temperature, etc.), current and historical values after processing using an appropriate algorithm by the communication module 140, projections and trends of measurement levels (e.g., trends of blood glucose levels or temperature levels, etc.), comparisons of other values to patient-specific averages, calls to action as determined by the algorithms of the communication module (e.g., so that the receiver acts a mere display device, while the communication module 140 handles secured calculations) and other similar types of data.

[0133] The security services can be used to provide authentication to communicate with sensor 110 operations. Authentication can include challenge and response commands, challenge data commands, security certificate data, and secured keys used therewith. The BLE stack 265 can include additional software functions used by the BLE components of the communication module 140.

[0134] For the purpose of illustration and not limitation, reference is made to the example embodiment of a procedure 2000 for a sensor-receiver connection for use with the disclosed subject matter as shown in FIGS. 20A-20B. FIGS. 20A-20B illustrates an example diagram for a BLE sequence to set up an initial connection and re-connection between a receiver 120 and sensor 110. At 2001, the sensor 110 repeatedly advertises its connection information to its environment in a search for a receiver 120 to connect to. As described herein, the sensor 110 can repeat advertising on a regular basis until a connection is established. The receiver 120 detects the advertising packet and scans and filters for the sensor 110 to connect to through the data provided in the advertising packet. At 2002, receiver 120 sends a scan request command and at 2003 the sensor 110 responds with a scan response packet providing additional details. The receiver 120 scans and filters for the sensor 110 through the data provided in the advertising and scan response packet. Once the sensor 110 is found and the receiver 120 learns the Bluetooth device address, at 2004 the receiver 120 sends a connection request using the Bluetooth device address associated with the receiver 120. The receiver 120 can also continuouslyrequest to establish a connection to a sensor 110 with a specific Bluetooth device address, if receiver 120 is configured for such capability. At 2005, the devices establish an initial connection allowing them to begin to exchange data. The devices then begin a process to initialize data exchange services and perform a mutual authentication procedure.

[0135] During the first connection between the sensor 110 and receiver 120, the receiver 120 can, at 2006, initialize a service, characteristic, and attribute discovery procedure. The receiver 120 can evaluate these features of the sensor 110 and store them for use during subsequent connections to the same sensor 110. At 2007, the devices enable a notification for a customized security service used for mutual authentication of the sensor 110 and receiver 120. The notification is enabled from the descriptor of the security characteristics. At 2008, a mutual authentication procedure added to the typical Bluetooth exchange sequence to ensure that the receiver 120 trying to access the sensor 110 is authenticated. The mutual authentication procedure is automated and requires no user interaction. At 2009, following the successful completion of the mutual authentication procedure, the sensor 110 sends a connection parameter update to request the receiver 120 to use connection parameter settings preferred by the sensor 110 and configured to maximum longevity. At 2010, the receiver 120 enables the notifications from the descriptor of data characteristics. The notification also serves as a notice to the sensor 110 that the receiver 120 is ready to receive encrypted data and is capable of decrypting that data as it arrives.

[0136] The receiver 120 then performs sensor control procedures to backfill historical data, current data, event log, and factory data. At 2011, the receiver 120 sends a request to initiate a backfill process for historical measurement reading data (e.g., historical glucose readings). The request can specify a range of records that the receiver 120 is interested in receiving, where the range is defined based on the measurement value, timestamp, or similar. At 2012, the sensor 110 sends historical measurement data until all previously unsent data in the memory of the sensor 110 is delivered to the receiver 120. At 2013, the receiver 120 sends a request to initiate a backfill process for current measurement reading data (e.g., clinical glucose readings). As with the historical measurements, the request can specify a range of records that the receiver 120 is interested in receiving, where the range is defined based on the measurement value, rawreading values contributing to the measurement, timestamp, or similar. At 2014, the sensor 110 sends measurement data until all previously unsent data in the memory of the sensor 110 is delivered to the receiver 120. At 2015, the receiver 120 sends a request to initiate a backfill process for event logging data. Turning to FIG. 20B, at 2016, the sensor 110 sends logged event data to the receiver 120 until all previously unsent data in the memory of the sensor 110 is delivered. At 2017, the receiver 120 sends a request to initiate a backfill process for sensor 110 device factory data. At 2018, the sensor 110 sends stored factory data to the receiver 120 until all previously unsent data in the memory of the sensor 110 is delivered.

[0137] Each request can include a specification for the order in which data will be received (e.g., oldest to newest, newest to oldest, highest to lowest, etc.). At any point, if the sensor 110 receives a backfill request when the sensor 110 is already processing a previously received request, the sensor 110 can automatically respond with an error message indicating that the sensor 110 is occupied. The sensor 110 can also respond with an error to any malformed requests (e.g., the data record type is invalid, the order is invalid, the timestamp is invalid or malformed, or records not available). The response can indicate the malformation. Although not illustrated, the sensor 110 can respond to a backfill request from the receiver 120 that all data has already been sent. Subsequent to each request, the receiver 120 can detect that no additional data is being sent and interpret that as acknowledgment that all data has been delivered. Alternatively, the sensor 110 can affirmatively deliver a transmission complete message. The sensor 110 can also support receiving backfill abort commands. Upon receiving an abort command, the sensor 110 can respond with an error response if it is currently processing another command. Otherwise, the sensor 110 determines whether the backfill operation which is being aborted is actually in progress (and sends an error if not), terminates the process, and sends a success notification to the receiver 120. Having completed the backfill updates, sensor 110 and receiver 120 are ready to begin regular measurement reading transmission. At 2019, the receiver 120 can send a notification to sensor 110 indicating that it is ready to receive the regular measurement readings. The notification can act as a reminder to the sensor 110 that the receiver 120 is ready to receive encrypted measurement data and decrypt the measurement data. The sensor 110 sends across current data in two notifications, shown at 2020 and 2021 including a first notification(2020) of current measurements and a second notification (2021) of current glucose result on a repeating basis. As embodied herein, the first notification and second notification can be redundant notifications to ensure that data is transmitted correctly. Alternatively, the two notifications can make up a single payload and be concatenated together to form the complete data collection for a single measurement. As an example, the sensor 110 can send the notifications each minute until the connection is interrupted or the devices disconnect.

[0138] For purpose of illustration and not limitation, reference is made to the example embodiment of a procedure 2100 for a sensor-receiver connection for use with the disclosed subject matter as shown in FIGS. 21. FIG. 21 illustrates an example diagram for a BLE sequence to send a shutdown command to the sensor 110. The shutdown command requests the sensor 110 to shut itself down. As described herein, the shutdown operation is executed immediately if the sensor 110 is in either the error state 620, insertion failed state 540, or sensor expired state 565. If the sensor 110 is not in those states, the sensor 110 would register the command in its internal memory 141 and execute the shutdown when sensor 110 transitions into the error state 620 or sensor expired state 565. Prior to the receiver 120 sending the shutdown command, the sensor 110 and receiver 120 can have exchanged data. For example, at 2101 the sensor 110 and receiver 120 have performed the backfill operations described herein or, at 2102, the sensor 110 and receiver 120 have sent event records and measurement data as described herein. At 2103, the receiver 120 sends a properly formatted shutdown command to the sensor 110. At 2104, if the sensor 110 is actively processing another command, the sensor 110 will respond with a standard error response indicating that the sensor 110 is busy. Otherwise, at 2105, the sensor 110 sends a response as soon as the command is received. Additionally, at 2106, the sensor 110 sends a success notification through the sensor control characteristic to acknowledge the sensor 110 has received the command. At 2107, the sensor 110 registers the shutdown command. At the next appropriate opportunity (e.g., depending on the current sensor state, as described herein), the sensor 110 will shut down. In some embodiments, the receiver 120 uses the shutdown command to notify the sensor 110 that receiver 120 has successfully backfilled all current measurement data, historical measurement data, and event logs.

[0139] As embodied herein, the sensor 110 and receiver 120 can be configured compliant with a security interface designed to protect the Confidentiality, Integrity and Availability ("CIA") of this communication and associated data. To address these CIA concerns, security functions can be incorporated into the design of the hardware and software. In particular embodiments, the sensor 110 can be configured to restrict access of certain functions to authorized parties only. The operator of the medical monitoring system 100 can control which parties are able to access specific functions and can revoke access to the functions within a reasonable timeframe. Moreover, the sensor 110 itself can limit access to certain functionality based on receiving evidence of authorization while still remaining available for use with receivers 120, multi-purpose data receiving devices (e.g., executing an authenticated application and / or software library provided by the operator of the medical monitoring system 100), and other authorized parties for debugging, reprogramming, and other manufacturing-specific features. Confidentiality of commands and user data stored on and transmitted between devices is maintained through hardware- and software-implemented security features. Source integrity of session data and commands can be assured. Additionally, software features can empower other features, such as restricting access to the communication interfaces, including but not limited to the communication module 140, NFC radio 135, and the like, to one or more selected receivers 120. In particular embodiments, the selected receivers 120 can include the one or more receivers 120 (or other devices) that last paired with the sensor 110 through another communication interface. In particular embodiments, access to longer- range communication interfaces (e.g., BLE, Wi-Fi) can be restricted based on last access to communication interfaces that requires proximity (e.g., NFC). The systems and techniques to effectuate these goals will be described herein.

[0140] Both the sensor 110 and a receiver 120 can ensure the authorization of the other party in a communication session. To determine if a party has authorization to, for example, issue a certain command or receive certain data, the identity of the party can be authenticated. In particular embodiments, identity authentication can be performed through two features. First, the party asserting its identity (e.g., a sensor 110 to a receiver 120 or a receiver 120 to a sensor) provides a validated certificate signed by the manufacturer of the device or the operator of the medical monitoring system 100. Second, authentication can be enforced through the use of public keys and private keysestablished by the devices of the medical monitoring system 100 or established by the operator of the medical monitoring system 100 and provided to the devices. To confirm the identity of the other party, the party can provide proof that the party has control of its private key. As described herein, proof of control can be established through mutual authentication or establishment of a mutual security key.

[0141] In some embodiments, the format and size of the certificate that is provided by the sensor 110 can vary from the format and size of the certificate that is provided by the receiver 120 or by an application executing on the multi-purpose medical monitoring device 130. As an example, the certificate used by the receiver 120 can use additional memory (compared to the sensor 110) and provide additional information within its certificate. The certificate can include a certificate security version, an identifier for the receiver 120, a validity revision value, access control configuration information, a receiver public key, and a digital signature. The certificate security version can be used to determine the structure and / or signing key required for the certificate to be valid. The identifier can be used to ensure that the certificate corresponds to the receiver 120 that is exchanging the certificate. Additionally, the sensor 110 can store a database (e.g., as a lookup table) for the supported certificate revision for that party. In particular embodiments, the supported party revision database can be loaded to the memory of the sensor 110 during secure updates, such as, but not limited to, during manufacture, during servicing by the manufacturer or a trusted agent, during firmware update, etc. The validity revision value can be used to determine if the certificate is valid and supported by the sensor 110. The access control configuration information can be used to directly determine what features and functionality of the sensor 110 are accessible by the receiver 120. The receiver public key can correspond to the public key for the receiver 120 according to the medical monitoring system 100. The digital signature can be used to provide validity of the certificate and detect or prevent tampering of the certificate by a malicious party. The digital signature can be signed by a private key of the operator of the medical monitoring system 100 and be validated by a corresponding key held by the sensor 110.

[0142] The sensor 110 can accept a certificate as valid based on verifying certain information associated with the certificate. For example, the sensor 110 can check if the certificate security version is a version supported by the sensor 110. As discussed herein,security versions can be rejected by the operator of the medical monitoring system 100. Rejected or other unsupported certificate security versions can be refused by the sensor 110. As another example, the sensor 110 can determine if the digital signature is valid. As described, the digital signature can be signed by a private key of the operator of the medical monitoring system 100. The corresponding public key can be written to the sensor 110 during secured operations. The digital signature, and correspondingly, the information stored in the certificate, can be validated using public key cryptography. As another example, the sensor 110 can check if the certificate is not expired. In some cases, the certificate data can include an express or implicit expiration date. The sensor 110 can compare the expiration date to a trusted source of time and reject the certificate if the expiration date has passed. In other cases, the sensor 110 does not have access to a trusted source of time. In such cases, the certificate validity revision can be used. If the certificates validity revision is less than the supported revised stored by the sensor 110 for that party, the certificate is deemed invalid. Other validity checks can also be used. Once all validity checks are passed, the public key embedded in the certificate can be extracted for use.

[0143] As an example, the certificate used by the sensor 110 can include a certificate security version, a sensor serial number or other unique identifier, a manufacturing date stamp, a sensor public key, and a digital signature. As with the receiver certificate, the certificate security version can be used to determine the structure and / or signing key required for the certificate to be valid. The sensor serial number or other unique identifier can be used to ensure that the certificate corresponds to the receiver 120 that is exchanging the certificate. Additionally, the receiver 120 can store a database (e.g., as a lookup table) corresponding to select sensor identifiers, such as a blacklist (to block old sensors or sensor identifiers known to be used by malicious parties) or a whitelist (to expedite recognition of certificates from trusted sensors). The sensor public key can correspond to a public key for the sensor 110 according to the medical monitoring system 100. The digital signature can be used to provide validity of the certificate and detect or prevent tampering of the certificate by a malicious party. The digital signature can be signed by a private key of the operator of the medical monitoring system 100 and be validated by a corresponding key held by the receiver 120.

[0144] The receiver 120 can accept a certificate as valid based on verifying certain information associated with the certificate. For example, the receiver 120 can check if the certificate security version is a version supported by the receiver 120. As discussed herein, security versions can be invalidated by the operator of the medical monitoring system 100. Invalidated or other unsupported certificate security versions can be refused by the receiver 120. As another example, the sensor 110 can determine if the digital signature is valid. As described, the digital signature can be signed by a private key of the operator of the medical monitoring system 100. The corresponding public key can be written to the receiver 120 during secured operations. The digital signature, and correspondingly, the information stored in the certificate, can be validated using public key cryptography. As another example, the receiver 120 can check if the manufacturing date stamp is associated with a valid range of dates and is particularly not associated with an expired sensor 110. As discussed herein, sensors 110 can be relatively low cost and designed to be disposable with a limited shelf life. The receiver 120 can use the known shelf life of a sensor 110 to determine if the sensor 110 associated with the certificate is likely expired. Additionally, the receiver 120 can check if the sensor identifier is stored in the database of known sensor identifiers and particularly determine if the identifier associated with the certificate is blacklisted. Other validity checks can also be used. Once all validity checks are passed, the public key embedded in the certificate can be extracted for use.

[0145] To facilitate the confidentiality of data, communication connections between the sensor 110 and receiver 120 can be mutually authenticated prior to transmitting sensitive data by either device. In particular, once the certificates are accepted by both the sensor 110 and the receiver 120, the public keys extracted from the certificates can be used during the mutual authentication process. With public keys in hand, both parties must prove they have access to the corresponding private keys. This proof may be established using challenge-response mechanisms. During such a mechanism, one party sends the other party data to be encrypted or signed using the private key. The receiving party signs or encrypts the data using the private key and returns it to the initiating party. The initiating party decrypts the encrypted data and verifies that the plaintext is correct. To prevent replay attacks, the plaintext data that is used is unpredictable (e.g., truly random) and / or non-repeatable.

[0146] Example mutual authentication schemes include direct signing of random data using a digital signature algorithm. The sensor 110 and receiver 120 send a random sequence of bytes to be signed with the other's private key. The sensor 110 and receiver 120 then check the signature of the signed data. As another example, the sensor 110 and receiver 120 can perform mutual authentication using symmetric cryptography. Using the recovered public keys, the sensor 110 and receiver 120 conduct a key exchange to arrive at a shared symmetric key for forward-messaging security. In particular embodiments, the key exchange used can be based on or derived from industry standard and / or government regulated security key exchanges.

[0147] In one embodiment, the key exchange used by the devices includes can be based on exploiting the infeasibility of an unauthorized party discovering base large numbers (e.g., prime numbers) used in certain mathematical operations. In an example, the two parties to the key exchange can agree to use a particular finite cyclic group of a large order and a generating element within the group, such as public modulus and base, where the base is a primitive root of the modulus. Each party generates a public value from the base raised to the power of the private key modulo the public modulus. The result is exchanged. The operation is repeated with the exchanged result to arrive at the secret key. For example, party A has secret value a, and party B has secret value b. A and B agree to use modulus m and base c. A calculates a value a' = ca mod p. B calculates a value b' =cb mod p. A and B exchange a' and b'. Then, A calculates the shared key s = b' a mod p and B calculates the shared key s = a'*b mod p. In another example, each party to the key exchange can select two large prime numbers and an auxiliary value. Each party can generate a public key based on the two large prime numbers which are kept secret from the public. The large prime numbers can form the private key. Messages encoded using the public key can be decrypted only by the private key. In particular, as described herein, the public key can be used to encode a shared secret key. More specifically, each party selects two distinct prime numbers p and q. Throughout the process, p and q are key secret. Part of the public key n is computed as n = pq. A function A(n) = lcm(p - 1, q - 1) is calculated. An integer e is selected such that e and A(n) are coprime. The integer e is released as the public key. Finally, d, the private key exponent, is selected as the modular multiplicative inverse of e modulo A(n). Then, the public key includes n and e. The private key consists of d, which can be derived from p, q, and A(n) which are also kept secret. Theparties can exchange and sign a shared key derivable from each party's public key and verifiable from each party's private key.

[0148] In another embodiment, the key exchange used by the devices can be based on exploiting the infeasibility of an unauthorized party discovering the discrete logarithm of a random elliptic curve element with respect to a publicly known base point. Stated differently, the security of said key exchange is based on the inability to easily compute the multiplicand of a point multiplication given the original and product pairs. Such a key exchange implementation has the additional benefit of reducing the necessary key size, allowing for benefits in the amount of storage memory used to hold the resulting keys as well as reducing the network traffic used in establishing the shared key.

[0149] In another embodiment, the key exchange used by the devices can be based on the difficulty of problems over a cyclic group G relating to computing a discrete logarithm. G can be, for example, the multiplicative group of integers modulo n. Like other embodiments described herein, the key exchange is based on a public-private key pair. To generate the keys, a party generates a cyclic group G of order q with a generator g. Element e represents the unit element of G. An integer x is selected randomly from the group of {1, . . . , <7 - 1}. The value h = gxis computed. The public key is the set of values G, q, g, and h. The private key is x. To encrypt a message, M, a second party maps M to an element m of G. The second party chooses an integer / from the set of integers {1, . . . , <7 - 1}. A shared secret, s, is computed as s = hy. The ciphertext ci and C2 is computed as ci = gyand C2 = m s. Upon receiving ci and C2 the first party can generate the shared secret as s = cix. The original message M is remapped from m = C2S1. The two parties can exchange data using the shared secret s as a shared symmetric key or can newly generate a shared secret for each message exchange for added security.

[0150] Once established, the shared symmetric key is then used to perform a mutual authentication such that each device proves control of the corresponding private key by arriving at the same symmetric key and being able to complete mutual authentication using that key. This version of the mutual authentication can be particularly advantageous where an encrypted channel is to be established for communication after authentication (as the shared symmetric key can be used to encrypt communications using the encrypted channel). Additionally, subsequent authentications can be done using the shared symmetric key. The overhead, in terms of computational complexity andnetwork traffic use, is not necessary except during establishment of the initial key. The sensor 110 and receiver 120 can provide evidence of control of the shared symmetric key on subsequent communication attempts. Additionally, or alternatively, as embodied herein, session key information, which can be used to encrypt the communication, can be exchanged between the sensor 110 and receiver 120 after the devices have each been authenticated. The sensor 110 and receiver 120 can provide evidence of control of the session key on subsequent communication attempts. The symmetric mutual authentication techniques used can be implemented, be based on, or be derived from two-pass or three-pass authentication techniques. In certain embodiments, four-pass or five-pass authentication can be used, with the manufacturer of the sensor 110 and / or receiver 120 or operator of the medical monitoring system 100 acting as the trusted additional party.

[0151] FIG. 35 illustrates an overview of the certificate exchange and validation process as well as the symmetric mutual authentication. At 3501, the receiver 120 sends a request to initialize the connection process. At 3502, the receiver 120 sends the certificate data of the receiver 120 to the sensor 110. Sending the certificate data can include alerting the sensor 110 that the receiver 120 will be sending certificate data, transferring the certificate data, and sending a confirmation message to the sensor 110 indicating that the certificate data has been transferred. At 3503, the sensor 110 checks that the certificate data is valid using the techniques described herein. At 3504, after determining that the certificate data is valid, the sensor 110 extracts the public key corresponding to the receiver 120 from the certificate data.

[0152] At 3505, the sensor 110 can send a notification to the receiver 120 indicating that the certificate data has been accepted. At 3506, the sensor 110 sends the certificate data of the sensor 110 to the receiver 120. Sending the certificate data can include alerting the receiver 120 that the sensor 110 will be sending certificate data, transferring the certificate data, and sending a confirmation message to the receiver 120 indicating that the certificate data has been transferred.

[0153] At 3507, the receiver 120 checks that the certificate data is valid using the techniques described herein. At 3508, after determining that the certificate data is valid, the receiver 120 extracts the public key corresponding to the sensor 110 from the received certificate data. At 3509, the receiver 120 generates a new public key andprivate key pair to use for mutual authentication. As described herein, the receiver 120 can use a random value or a combination of random, known, and non-sequential values to generate the public key and private key pair. At 3510, the receiver 120 initiates the mutual authentication procedure. The receiver 120 can send a notification or request to the sensor 110. The receiver 120 can additionally or alternatively send the public key generated at 3509. The receiver 120 can additionally notify the sensor 110 when the complete public key has been sent. At 3511, the sensor 110 generates a new public key and private key pair to use for mutual authentication using the techniques described herein. At 3512, the sensor 110 sends the public key generated at 3511 to the receiver 120. The sensor 110 can send a notification or request to the receiver 120. The sensor 110 can additionally or alternatively send the public key generated at 3511. The sensor 110 can additionally notify the receiver 120 when the public key has been sent. At 3513, the receiver 120 generates the shared key used for mutual authentication using the private key of the receiver 120, the public key of the sensor 110, any previously agreed upon secret values (e.g., supplied by the manufacturer of the sensor 110 or receiver 120 or the operator of the medical monitoring system 100), and / or any selected nonce values. Similarly, at 3514, the sensor 110 generates the shared key use for mutual authentication. At 3515, the sensor 110 and receiver 120 can coordinate to perform a mutual authentication scheme using the shared key and generated check values.

[0154] An unauthorized receiver 120 can initiate a denial-of-service attack against the sensor 110 by blocking other devices from connecting to the sensor 110 by staying connected or repeatedly attempting to connect to the sensor 110. To prevent this type of attack, the connection between the sensor 110 and authorized receiver 120 can be terminated if symmetric mutual authentication has not been completed within a predefined amount of time. Additionally, or alternatively, the unauthorized device can also be blocked from initiating a subsequent communication request for some time. This allows authorized devices to access the sensor 110 when it becomes connectable again (e.g., while the unauthorized device is blocked).

[0155] In certain embodiments, data exchanged using a first communication protocol can be used to further enhance the security of communications using a second communication protocol. As an example, a first communication protocol can be a short- range communication protocol in which physical proximity is required due to, forexample, the communication range of the protocol (e.g., NFC). The second communication protocol can be a longer-range communication protocol in which the communication range is longer and therefore physical proximity not as predictable (e.g., BLE, Wi-Fi). In such embodiments, a secret can be shared between a sensor 110 and a receiver 120 using the first communication protocol. In particular embodiments, the secret can be a binding key or binding identifier between the sensor and the receiver 120. The secret can be used on subsequent authentication attempts (e.g., used in combination with randomized data for a symmetric mutual authentication). The secret can be generated as an encrypted value shared over the short-range communication protocol. In environments where other devices can be snooping for data exchanged between the sensor 110 and a receiver 120 using the first communication protocol, a form of a mutual authentication can be performed using the first communication protocol where the result is used as the secret.

[0156] The secret can be used by the sensor 110 to prioritize establishing communication sessions with particular receivers 120. For example, the sensor 110 can store a listing of secrets shared with receivers 120. The receiver 120 can refuse to establish communication sessions with receivers 120, even if they have a pre-existing shared key, unless they can provide the most recent secret. The secret, therefore, can be used to revoke access to the sensor 110 from other receivers 120 (e.g., an older receiver after the user has upgraded). Additionally, or alternatively, the receiver 120 can refuse a connection to a receiver 120 with an older secret than the most recent secret until a threshold amount of time has passed (e.g., if the preferred receiver 120 is not available). The exchange of secrets adds a layer of physical security to the mutual authentication schemes, because physical proximity can be required to exchange the secret using the first communication protocol.

[0157] As embodied herein, certain values used in the authentication process are provided to the devices during manufacture. As an example, private keys and certificate values held by the sensor 110 or receiver 120 can be set by their respective manufacturer. Values such as the private keys and certificate values can be written to memory with a limited number of rewrites, such as non-reprogrammable or one-time programmable (OTP) memory in a containerized manner. In particular embodiments, the values can be updated as security enhancements are made or in order to reduce the known valuesavailable to an unauthorized entity. The values can be updated through voiding existing containers and redirecting execution flow to a replacement container with the updated values. In particular embodiments, a version number, timestamp, or other identifier attributed to the security configuration of the sensor 110 or receiver 120 can be used by another device attempting to authenticate the sensor 110 or receiver 120 to determine how to evaluate an offered certificate or public key. Therefore, the security architecture can be updated over time and can support overlapping environments that can develop where, for example, sensors 110 are intended as single- or limited-use devices and are not reprogrammable.

[0158] Through a similar mechanism, certificates associated with a receiver 120 and / or a software application executing on a receiving device in communication with the sensor 110 can be invalidated or rejected for use. As an example, the manufacturer of sensors 110 or operator of the medical monitoring system 100 can revoke certificate agreements between the manufacturer or operator and a formerly authorized entity to ensure consumer security. The manufacturer can update the security version on newly produced sensors 110 to a version that does not support certificates associated with the formerly authorized entity, which will cause the sensors 110 to exclude or refuse to connect with receivers 120 associated with the entity. As sensors 110 can be designed with a limited usable lifetime and / or shelf life, older sensors 110 will eventually age out of the field, ensuring that the certificate revocation is made effective. Additionally, or alternatively, certificates associated with individual manufacturers of receivers 120 can be revoked by updating the database stored in the sensor 110 for supported certificate revisions for that party. When establishing a communication session, the sensor 110 queries the certificate revision value database using the manufacturer identifier for the receiver 120. If the certificate revision value provided by the receiver 120 does not match the version number supported by the sensor 110, then the communication session is rejected, effectively revoking the certificate and blocking access to the sensor 110 by the receiver 120.

[0159] The ASIC hardware abstraction layer 200 can include software functions to enable the communication module to communicate with the ASIC 130 via the serialperipheral interface 300. As shown by the arrows connecting the ASIC hardware abstraction layer 200 and other components, the ASIC hardware abstraction layer 200includes a variety of functions to enable the communication module 140 to write to, read from, and control the ASIC 130. For example, the ASIC hardware abstraction layer 200 supports ASIC drivers 270 exposing various functions of the ASIC 130 to the communication module. The OTP emulators 275 can include software functions to emulate and enable access of the communication module 140 to the OTP memory 131 of the ASIC 130, for example, the internal RAM and serial memory.

[0160] The core framework 280 can include functions underlying fundamental operation of the ASIC 130. These functions include the necessary core operations allowing for the ASIC 130 to execute, such as the processor scheduler, interrupt handler, memory manager, and timer utility. The hardware abstraction layer 285 can include functions tying into the various low-level hardware components of the ASIC 130. These functions includes functions relating to the boot sequencer, power manager, voltage monitor, and other hardware drivers.

[0161] For purpose of illustration and not limitation, reference is made to the example embodiment of a physical and logical serial-peripheral interface 300 between the ASIC 130 and communication module 140 for use with the disclosed subject matter as shown in FIG. 3. The SPI logical interface maps to the registers and register settings of the ASIC 130. Certain registers of the ASIC 130 are read-only. Additionally, or alternatively, certain registers can be written as well as being read. Designated operations allow for the SPI dominant to read and write ASIC registers. Elements of the logical interface (and valid registers of the ASIC 130) that are read only include interrupt requests. Elements of the logical interface (and valid registers of the ASIC 130) that are write only include NFC response flags and error codes, NFC response valid payloads, and NFC response data. Elements of the logical interface (and valid registers of the ASIC 130) that can be read and written include a unique identifier, calculated data, trimmed data, outlier status, temperature measurements, measurement status, and current measurement results.

[0162] As illustrated for example in FIG. 3, the ASIC hardware of the serial- peripheral interface 300 includes an ASIC digital section 310 and physical serial-peripheral interface hardware 133. The SPI hardware 133 can include an SPI clock 325. The SPI hardware of the communication module includes a digital section 330. In the illustrated embodiments, one of the ASIC 130 and communication module 140 is designated as the role of the SPI dominant and the other is designated as the SPI submissive. Particularly,the ASIC 130 is the SPI submissive and has a submissive logical interface 340. The communication module 140 is the SPI dominant and has a dominant logical interface 350. The submissive logical interface 340 and dominant logical interface 350 are connected via a logical connection. The SPI logical interface 300 specifies the connection between the ASIC 130 and the communication module 140 at the logical register level. The ASIC Hardware Abstraction Layer 200 module of the software blocks 145 forms messages with their parameters as the SPI dominant, and the ASIC digital section 310 contains the registers and the logic to read and write them. As embodied herein, the SPI clock frequency is set to the maximum allowable by the ASIC 130 (e.g., 3 MHz). FIG. 3 further illustrates the four wire physical SPI interface between the SPI hardware 133 of the ASIC 130 and the digital section 330 of the communication module. The physical SPI interface includes a connection between the SEL pin 361 of the ASIC 130 and a counterpart 371 of the communication module 140, the CLK pin 363 of the ASIC 130 and a counterpart 373 of the communication module 140, the MOSI pin 365 of the ASIC 130 and a counterpart 375 of the communication module 140, and the MISO pin 367 of the ASIC 130 and a counterpart 377 of the communication module 140. For the purpose of illustration and not limitation, example sequences of read and write messages suitable to accomplish various functionality and use case scenarios of the system are described herein with reference to the corresponding diagrams.

[0163] For the purpose of illustration and not limitation, reference is made to the example embodiment of a high-level functional depiction of a successful lifecycle of the sensor during its operations as shown in FIG. 4. FIG. 4 illustrates an example activity diagram for the nominal, successful lifecycle of the sensor 110 described herein with respect to example embodiments. The communication connection process (e g., the establish secure connection state 450 and maintain connection state 460) is described herein. Once the sensor 110 is activated, the communication stack attempts to connect to a paired receiver 120 through established communication procedures (e.g., standard BLE communication protocols) and complete a proprietary authentication process. The communication connection process, represented by state 450, and the maintenance of the connection, represented by state 460, can occur in parallel and can be asynchronous with the measurement process, represented by states 420-440. The measurement datais transferred from the ASIC 130 to the communication module 140 for notification to the receiver 120.

[0164] State 410 represents the activate sensor state of the sensor 110 lifecycle. The activate sensor process consists of a series of transactions (e.g., NFC transactions) between the ASIC 130 and the communication module 140, facilitated by the radio hardware abstraction layer 200. The activate sensor state 410 is described in further detail herein, e.g., with respect to FIGS. 9A-9B. After the sensor 110 is activated, the sensor 110 can advance to the insertion detection state 420.

[0165] The insertion detection state 420 represents the stage of the sensor 110 lifecycle in which the sensor 110 determines whether the sensor 110 has been successfully attached to the body of the patient, and whether the medical hardware 155 has been correctly attached, as applicable based on the type of hardware. For example, if the medical hardware 155 includes a blood glucose analyte sensor, the sensor 110 can determine whether the medical hardware 155 has been properly inserted and is capable of reading glucose levels appropriately. The insertion detection state 420 is described in further detail herein, e.g., with respect to FIG. 10. After the sensor 110 insertion is verified, the sensor 110 can advance to the measurement lifecycle state 430.

[0166] The measurement lifecycle state 430 represents the stage at which the sensor 110 is actively recording measurements from the medical hardware 155 and transmitting the measurements to an applicable receiver 120. The measurement lifecycle state 430 is described in further detail herein, e.g., with respect to FIGS. 11-12. At the conclusion of the sensor measurement lifecycle, the sensor can enter a normal termination state 440 during which the sensor wraps up operation and prepares for disposal. The normal termination state is described in further detail herein, e.g., with respect to FIG. 18.

[0167] For purpose of illustration and not limitation, reference is made to the example embodiment of a high-level depiction of a state machine representation 500 of the actions that can be taken by the sensor 110 as shown in FIG. 5. FIG. 5 illustrates a state machine representation of the functions of the sensor described herein with respect to example embodiments. After initialization, the sensor enters state 505, which relates to the manufacture of the sensor. During the manufacture state the sensor 110 can be configured for operation, for example, the one-time programmable memory of the communication module can be written. Other operations requiring increased securityprotocols can be performed with respect to the sensor. At various times while in state 505, the sensor can trigger the state 510, in which the sensor checks whether a received command is a command to go to the storage state 515. If no "go to storage state" command has been received, the sensor 110 returns to state 505. If a "go to storage state" command has been received, the sensor 110 advances to the storage state 515.

[0168] Upon entry to the storage state 515, the sensor performs a software integrity check. While in the storage state 515, the sensor can perform other operations, including, as an example, resetting variables relating to the operation of sensor 110, such as the active time of operation of the sensor 110, the activation time of the sensor 110, identification information of devices authenticated to communication with the sensor 110, and resetting data management functions (e.g., to preserve or erase sensitive data from the device). The storage state 515 can generally relate to operations to facilitate the sensor 110 being made available to an end user (e.g., a patient). As embodied herein, the storage state 515 can also relate to data recovery and preservation operations (e.g., committing data stored in volatile memory to non-volatile memory) so that the sensor 110 can be shut down in a controlled manner and avoid data loss.

[0169] While in the storage state, the sensor can receive a sensor testing mode command and advance to the testing state 520. The testing state 520 can be used to repair or debug the sensor 110 and can involve enabling additional security privileges to analyze the memory and operations of the sensor that are not ordinarily available during normal operation. While the sensor 110 is in the testing state 520, a functional tester system can check that the components of the sensor 110 function as designed. The communication module 140 can be programmed with adjustments to the configuration parameters. The functional test can include, for example, and without limitation, a reference board test, an off-current test, reading ASIC 130 registers, ASIC 130 leakage test, current offset calibration, a diagnostics scale factor calibration, power consumption tests, a communication module radio function test, or programming.

[0170] While in the storage state, the sensor can also receive an activation request command and advance to state 520, in which the sensor determines whether activation has been completed successfully, as described herein. If the activation is unsuccessful, the sensor returns to the storage state 515. If activation is successful, the sensor 110 advances to the insertion detection state 525.

[0171] Upon entry to state 525, the sensor 110 can store information relating to devices authenticated to communicate with the sensor as set during activation, initialize algorithms related to conducting and interpreting measurements from the medical hardware 155, initialize the ASIC 130 of the sensor 110, as described herein. The sensor 110 can also initialize the lifecycle timer, responsible to maintaining an active count of the time of operation of the sensor 110 and begin communication with authenticated devices to transmit recorded data. The sensor 110 can also perform additional operations while in the insertion detection state 525, including additional software integrity checks, recording initial measurements using the medical hardware 155 and related software functions, logging the measurements and transmitting results to an authenticated receiver 120. The sensor 110 can also increment the time of operation as appropriate.

[0172] While in the insertion detection state 525, the sensor can enter state 530, where the sensor 110 checks whether the time of operation is equal to a predetermined threshold. As described herein, this time of operation threshold can correspond to a timeout function for determining whether an insertion has been successful. If the threshold has not been reached, the sensor 110 returns to the insertion detection state 525 and continues to monitor measurements. If the time of operation has reached the threshold, the sensor 110 advances to state 535, in which the sensor 110 checks whether the average data reading is greater than a threshold amount corresponding to an expected data reading volume for triggering detection of a successful insertion. If the data reading volume is lower than the threshold while in state 535, the sensor advances to state 540, corresponding to a failed insertion. If the data reading volume satisfies the threshold, the sensor advances to the active paired state 555.

[0173] The insertion failed state 540 corresponds to operations used to determine the source of the failed insertion and recover from the failed insertion if possible. On entry to the insertion failed state 540, the sensor 110 can increment a counter used to track the number of insertion failures by the particular sensor 110 and can send the ASIC 130 into a storage mode state. The sensor 110 can also begin operations to determine whether there is a recoverable error in the sensor 110. For example, the sensor 110 can perform a software integrity check to determine if the error relates to the programming of the communication module, the sensor 110 can also determine whether the sensor 110 is connected via the communication module 140 to a receiving device. If not, thesensor 110 can attempt to establish connections (e.g., to offload any recorded data). While in the insertion failed state 540, the sensor 110 can receive a shutdown command 545, which can cause the sensor to return to the storage state 515. If no shutdown command has received, the sensor 110 can, at state 550, revert to the storage state 515 automatically after the time of operation has exceeded a predetermined time of unsuccessful operation (e.g., 30 minutes, 1 hour, two hours, 12 hours, etc.). If no affirmative shutdown command is received and the time of operation has not exceeded the threshold, the sensor 110 stays in the insertion failure state 540.

[0174] The active paired state 555 of the sensor 110 reflects the state while the sensor 110 is operating as normal by recording measurements, processing the measurements, and reporting them as appropriate to an authenticated, and connected, receiver 120. While in the active paired state 555, the sensor 110 sends measurement results or attempts to establish a connection with an authenticated receiver 120 to send the measurement results. The sensor 110 also increments the time of operation, as discussed herein. As described herein, the sensor 110 can be configured to operation for only a fixed period of time, for example, due to the limits of the ability of the medical hardware 155 to accurately record measurements or in order to preserve the health of the patient. At state 560, the sensor 110 monitors the stage of the time of operation. If the time of operation has not reached the threshold, the sensor 110 remains in the active paired state 555. Once the sensor 110 reaches a predetermined threshold time of operations (e.g., once the time of operation reaches a predetermined threshold), the sensor 110 transitions to the active expired state 565.

[0175] The active expired state 565 of the sensor 110 reflects the state while the sensor 110 has operated for its maximum predetermine amount of time. While in the active expired state 565, the sensor 110 can generally perform operations relating to winding down operation and ensuring that the collected measurements have been securely transmitted to receiving devices as needed. For example, while in the active expired state 565, the sensor 110 can transmit collected data and, if no connection is available, can increase efforts to discover authenticated devices nearby and establish and connection therewith. While in the active expired state 565, the sensor 110 can receive a shutdown command at state 570. For example, the sensor 110 can receive the shutdown command after it has offloaded stored measurements. If no shutdown command is received, thesensor 110 can also, at state 575, check if the time of operation has exceeded a final operation threshold. The final operation threshold can be based on the battery life of the sensor 110, with a goal of ensuring there is enough available battery to perform the final transmission of data. If the threshold is exceeded, at state 575 the sensor 110 transitions to the normal termination state 580. The sensor 110 can also transition to the normal termination state 580 upon receiving the shutdown command at state 570. The normal termination state 580 corresponds to the final operations of the sensor 110 and ultimately shutting down the sensor 110.

[0176] For the purpose of illustration and not limitation, reference is made to the example embodiment of a state machine representation 600 of the actions that can be taken by the sensor 110 as shown in FIG. 6. FIG. 6 illustrates a state machine representation of example functions of the sensor described herein. For example, the state machine representation 600 relates to the error states of the sensor 110. The sensor 110 can enter the error state machine upon prompting of an interrupt request by the ASIC 130 or communication module 140 or other similar interrupts. After initialization, the sensor 110 first determines whether the error is a fatal error at state 610. For example, a fatal error is an error from which the sensor 110 cannot recover. If the error is a fatal error, the sensor 110 proceeds immediately to the error termination state 650. If the error is not a fatal error, the sensor 110 proceeds to the error state 620.

[0177] Upon entry to the error state 620, the sensor 110 starts a termination timer relating to the amount of time that the sensor 110 has been in the error state. The sensor 110 also attempts to offload stored data to a more permanent storage (e g., to an applicable receiver 120) by communicating with a receiver 120 or attempting to establish a communication with the receiver 120. At state 630, the sensor 110 can receive a shutdown command, e.g., after offloading its stored measurement data and proceed to the error termination state 650. If no shutdown command is received at state 630, at state 640, the sensor 110 determines whether the termination timer has exceeded a predetermined threshold. The predetermined threshold can relate to an amount of time that the sensor 110 can attempt to salvage the stored data before the battery of the sensor 110 is expected to run out. If the threshold is not exceeded, the sensor 110 remains in the error state 620. If the threshold is exceeded, the sensor 110 transitions into the error termination state 650.

[0178] The error termination state 650 relates to processes performed by the sensor 110 in preparation of shutting down after encountering an error. Upon entry to the error termination state 650, the sensor 110 stops the termination timer and starts a new shutdown timer. Once the sensor 110 enters the error termination state 650, the sensor 110 can have a predetermined amount of time to operate before a shutdown is forced, which can be selected, for example, for security reasons, such as to reduce risks of illicit access to the sensor by triggering errors or other sensor malfunctions. At state 660, the sensor 110 determines whether the shutdown timer has reached the threshold amount of time before the shutdown is enforced. If not, the sensor 110 remains in the error termination state 650. If the shutdown timer has exceeded the threshold, at state 670, the sensor 110 determines whether a high-priority disable shutdown flag has been set. If the disable shutdown flag has been set, the sensor remains in the error termination state 650 until the flag is unset. The disable shutdown flag can be set as a result of the sensor 110 receiving a shutdown command from the receiver 120. If the disable shutdown flag is unset, the sensor terminates.

[0179] For purpose of illustration and not limitation, reference is made to the example embodiment of a state machine representation 700 of the actions that can be taken by the ASIC 130 as shown in FIG. 7. FIG. 7 illustrates a state machine representation 700 of the functions of the ASIC 130 described herein with respect to example embodiments. After initialization, the ASIC 130 enters the storage mode state 710. When an NFC field approaches the ASIC 130, the ASIC 130 transitions to the wake-up state 720. When the NFC field near the ASIC 130 drops, the AISC 130 returns to the storage mode state 710. While in the wake-up state, if the one-time programmable memory is validated before the NFC field drops, the ASIC 130 transitions to the activation sequence 730. While in the activation sequence 730 the ASIC 130 can receive a number of commands to return the ASIC 130 to the storage mode state 710. For example, the ASIC 130 can determine it has timed out during the activation process and in response default to the storage mode 710. As another example, the ASIC 130 can receive a "go to storage mode" command over the serial-peripheral interface 300.

[0180] While in the activation sequence 730, the ASIC 130 can also receive a "go to selftest" command over the serial-peripheral interface 300. In response, the ASIC 130 advances to the self-test state 740. The self-test circuit (e.g., a reference built-in self-test)detects leakage currents on the reference terminal connecting the medical hardware 155 to the ASIC 130. In the example of the medical hardware being an analyte sensor, the sensor current being measured can be so low that the circuit board of the sensor 110 should be designed to reduce and capture surface leakage of measured current due to small amounts of, for example, contamination and moisture. Contamination can arise from flux residue or handling. Leakage can further arise at connections to different electrodes of the multi- electrode analyte sensor (for example at the working electrode connection and at the reference electrode connection). Leakage at the working electrode connection can be captured as part of device offset calibration. If the level of leakage exceeds a threshold value (e.g., if the required offset is too large) then the analyte sensor can be rejected during manufacture. The built-in self-test can be used to check for leakage at the reference electrode connection (which can be used to compare to the voltage from the working electrode connection). After completing the built-in self-test, the ASIC returns to the activation sequence state 730. FIG. 24 illustrates an example topology 2400 of the built-in self-test.

[0181] While in the activation sequence 730, the ASIC 130 can also receive a "go to measurement" command over the serial-peripheral interface 300. In response, the ASIC 130 advances to the measurement mode 760.

[0182] During the activation sequence 730 or the measurement mode 760, the ASIC 130 can proceed to the recovery sequence 750 in response to, for example, detection of a brownout as described herein with respect to FIGS. 15A-15B. In the event of a marginal brownout, the battery voltage supplied to the ASIC 130 temporarily dips below a battery level threshold for a little longer than a nominal threshold time, which would be long enough to leave the ASIC in storage mode and unrecoverable, even if the battery voltage were to recover eventually. As it can be desirable to have the ASIC 130 wake up from the marginal brownout condition, which can be the result of an electrostatic discharge, the ASIC 130 can use the interrupt request (IRQ) pin (e.g., the input-output pin corresponding to IRQ alerts from the communication module 140) for waking up.

[0183] When the ASIC 130 recovers from the brownout, the ASIC 130 returns to the activation sequence 730. If the ASIC 130 does not recover from the brownout while in the recovery sequence 750, the ASIC 130 returns to the storage mode 710.

[0184] For the purpose of illustration and not limitation, reference is made to the example embodiment of a state machine representation 800 of the actions that can be taken by the communication module 140 as shown in FIG. 8. FIG. 8 illustrates a state machine representation 800 of the functions of the communication module 140 described herein with respect to example embodiments. After initialization, the communication module 140 transitions to the ACTIVE RC state 810. While in the ACTIVE RC state 810, if the communication module 140 receives a "go to XTAL command", the communication module 140 transitions to the ACTIVE_XTAL state 820. In the ACTIVE_XTAL state 820, the radio of the communication module 140 is active and the microcontroller 143 executes application code (e.g., pending tasks).

[0185] While in the ACTIVE_RC state 810 or the ACTIVEXTAL state 820, if there are no pending tasks for the microcontroller 143 of the communication module 140, the communication module advances to the sleep state 830. While in the sleep state 830, the communication module enters a low power mode. The communication module 140 can receive a sleep timer interrupt request, causing the communication module 140 to transition back to the ACTIVE XTAL state 820.

[0186] While in any state (e.g., ACTIVE RC state 810, ACTIVE XTAL state 820, and sleep state 830) the communication module 140 receive a chip disable command. In response, the communication module 140 transitions to the disabled state 840. While in the disabled state 840, the communication module can receive an enable command, which causes the communication module 140 to transition to the ACTIVE RC state 810.

[0187] As embodied herein, the communication module 140 can keep itself enabled 15 independently of the ASIC 130 by using a general-purpose input-output (GPIO) pin to drive its enable line high. In this manner, the GPIO pin of the communication module 140 can be shorted directly to the corresponding enable pin, which can also be connected to a enable output pin of the ASIC 130. As described herein, when the sensor 110 is in a shelf (e.g., standby or storage) mode, the communication module 140 is in the disabled state 840 where said GPIO and enable pins are in a high impedance state and the enable output pin of the ASIC 130 is driving the enable line low. In the presence of an NFC field, the ASIC 130 can eventually drive the enable line high as ASIC 130 enters the activation state 730 to enable the radio. At substantially the same time, the GPIO pin can be briefly configured as an input with a pull-down resistor as the communication module powersup. The ASIC 130 has adequate drive strength to keep the enable line high during this process. After the communication module 140 has been initialized, the GPIO pin can be reconfigured as an output and thus drive the enable pin high. If the system encounters a brownout event, the enable line will be kept high by the GPIO of the communication module 140 even when the ASIC 130 is driving it low, which can be possible at least in part because of the weak low output level of the ASIC 130.

[0188] For the purpose of illustration and not limitation, reference is made to the example embodiment of a procedure 410 for sensor activation for use with the disclosed subject matter as shown in FIGS. 9A-9B. The sensor activation process includes a series of transactions between the ASIC 130 and the communication module 140, which can be facilitated by the hardware abstraction layer 200. Before a sensor is activated, the ASIC 130 resides in the low power storage mode state 710. In the storage mode state 710, a battery switch of the ASIC 130 is open and the communication module 140 is in a standby or low-power state. At this point, the activation process does not begin until an incoming RF field (e g., NFC field) drives the voltage of the power supply to the ASIC 130 above a reset threshold, which causes the sensor 110 to enter the wake-up state 720. While in the wake- up state 720, at 901, the ASIC 130 downloads OTP data into the main registers in the memory 131 and enters the activation sequence state 730. At 902, the battery switch will be closed, allowing for regular power to flow to the components of the sensor 110. At 903, the ASIC 130 wakes the communication module 140 by asserting an appropriate command along the SPI 300. The assertion passes, at 904 to the ASIC hardware abstraction layer 200, and to the communication module 140 at 905.

[0189] At 906, the communication module 140 is initialized, initializing the radio 148, triggering a power on self-test 970. The power on self-test 970 can include the ASIC 130 communicating with the communication module 140 using a prescribed sequence of reading and writing data from various registers of the ASIC memory 131 to verify the memory and one-time programmable memory are not corrupted and that the ASIC 130 and communication module 140 can successfully communicate. As an example, the ASIC 130 can be programmed by the manufacturer, with device-specific content in its memory, such as calibration and configuration data, unique values to identify the ASIC 130, etc. During manufacture of the sensor 110, the ASIC 130 device-specific information can also be written into the memory of the communication module 140 and verified. The device-specific information can be used during the power on self-test 970 as the subject data that is read from the ASIC memory 131. In particular, the device-specific information can be read by the communication module 140 and compared to the previously-stored device-specific information to ensure data integrity. If the comparison indicates no error, the power on self- test is completed. If there is a discrepancy in the data is determined, the sensor 110 can trigger the error termination state 650. At 907, the communication module 140 starts an activation timer. At 908, the ASIC 130 sends an inventory response out.

[0190] At 909, the ASIC 130 receives an incoming NFC request. The ASIC 130 notifies the communication module 140 of the incoming NFC request by asserting the IRQ pin at 910 through the ASIC hardware abstraction layer 200 which is passed onto the communication module 140 at 911. The communication module 140 requests read the registers containing IRQ status at 912. The ASIC hardware abstraction layer 200 passes the appropriate formatted request to the ASIC 130 at 913 which returns, at 914, the IRQ status data through the ASIC hardware abstract layer 200 at 915. At 916, the sensor 110 receives an NFC command and payload and, at 917, replies to the NFC command before, at 918 clearing the IRQ. Through the ASIC hardware abstraction layer 200, at 919, the sensor writes appropriate data to the designated registers.

[0191] Referring still to FIG. 9B, 920-31 illustrate example handling of an authenticated activation request. At 920, the ASIC 130 receives an incoming NFC request. The ASIC 130 notifies the communication module 140 of the incoming NFC request by asserting the IRQ pin at 921 through the ASIC hardware abstraction layer 200 which is passed onto the communication module 140 at 922. The communication module 140 requests to read the registers containing IRQ status at 923. The ASIC hardware abstraction layer 200 passes the appropriate formatted request to the ASIC 130 at 924 which returns, at 925, the IRQ status data through the ASIC hardware abstract layer 200 at 926. At 927, the sensor 110 receives an NFC command and payload. At 928, the communication module 140 authenticates the activation request. At 929, the sensor replies to the NFC command before, at 930 clearing the IRQ. Through the ASIC hardware abstraction layer 200, at 931, the sensor writes appropriate data to the designated registers in the ASIC memory 131.

[0192] With continued reference to FIG. 9B, 930-44 illustrate example procedures for advancing to the measurement mode state 760 after receiving another NFC command.At 932, the ASIC 130 receives an incoming NFC request. The ASIC 130 notifies the communication module 140 of the incoming NFC request by asserting the IRQ pin at 933 through the ASIC hardware abstraction layer 200 which is passed onto the communication module 140 at 934. The communication module 140 requests to read the registers containing IRQ status at 935. The ASIC hardware abstraction layer 200 passes the appropriate formatted request to the ASIC 130 at 936 which returns, at 937, the IRQ status data through the ASIC hardware abstract layer 200 at 938. At 939, the sensor 110 receives an NFC command and payload. At 940, the sensor replies to the NFC command before, at 941 clearing the IRQ. Through the ASIC hardware abstraction layer 200, at 942, the sensor writes appropriate data to the designated registers in the ASIC memory 131. Additionally, the communication module 140 issues a command, at 943 to go into measurement mode state 760. The command is passed to the ASIC 130 at 944 via writing the command to the appropriate register. The ASIC 130 then transitions to the measurement mode state 760 while the communication module 140 transitions to the insertion detection state 525.

[0193] For the purpose of illustration and not limitation, reference is made to the example embodiment of a procedure 420 for insertion detection for use with the disclosed subject matter as shown in FIG. 10. Initially, for example and as embodied herein, the ASIC 130 is in the measurement mode state 760 and the communication module is in insertion detection state 525. When the ASIC 130 enters the Measurement Mode 760 for the first time, an insertion detection sequence is performed to verify that the sensor 110 has been properly installed onto the patient's body before a proper measurement can take place. At 1001, the communication module 140 issues a command to activate the measurement configuration process. At 1002, the ASIC hardware abstract layer 200 issues the command to set a command register in the ASIC 130 to cause the ASIC 130 to enter measurement command mode. At 1003, the ASIC digital section 310 converts the command to the drive the appropriate working bias voltage in the predetermined register. The sensor 110 pauses, and the communication module 1005 waits for the counter drive loop to settle after setting the working bias voltage. The sensor 110 then temporarily enters the measurement lifecycle state 430 to runs a predetermined number of consecutive measurements to test whether the insertion has been successful. At 1005, the communication module 140 evaluates themeasurement results to determine insertion success. At 1007, when insertion is deemed successful, the sensor 110 enters the measurement lifecycle 430, in which the sensor 110 begins taking regular measurements (e.g., of temperature, glucose, and counter potential).

[0194] At 1006, if the sensor 110 determines that the insertion was not successful, sensor 110 is triggered into an insertion failure mode, in which the ASIC 130 is commanded back to Storage Mode 710 while the communication module 140 disables itself. In certain embodiments, the insertion failure mode first determines whether a communication connection has been established (e.g., a Bluetooth connection with an applicable receiver 120). If there is an existing connection, the receiver 120 sends the command for the sensor 110 to go back to the storage state. If there is no existing connection, or the connection is lost, the sensor 110 waits for a predetermined period of time for a connection to be established, allowing the sensor 110 to receive the go to storage state command from the receiver 120. If the predetermined period of time passes without a successful connection, the sensor 110 enters the storage state.

[0195] For the purpose of illustration and not limitation, reference is made to the example embodiment of a procedure for the measurement lifecycle 430 for use with the disclosed subject matter as shown in FIG. 11. The ASIC 130 begins the measurement lifecycle 430 in the measurement mode state 760. The measurement sequence begin with a burst read of IRQ status, previous measurement results, mode status, outlier status, measurement configurations, and other registers. The communication module 140 checks these data for application integrity to ensure that the sensor 110 is functional to perform the next measurement. For example, at 1101, the communication module issues a request to get previous measurement results. At 1102, the ASIC hardware abstraction layer 200 formats and issues a command to read the appropriate data from the relevant registers of the ASIC memory 131. At 1103, while the SPI clock toggles, the ASIC digital section 310 provides the data from the registers through the ASIC hardware abstraction layer 200, at 1104, to the communication module 140. In FIG. 11 1105-1108 illustrate a procedure for ensuring consistency of the values in the ASIC 130 registers. At 1105, the communication module issues a request to retrieve register data. At 1106, the ASIC hardware abstraction layer 200 formats and issues a command to read the appropriate data from the relevant registers of the ASIC memory 131. At 1107, while theSPI clock toggles, the ASIC digital section 310 provides the data from the registers through the ASIC hardware abstraction layer 200, at 1108, to the communication module 140.

[0196] During the measurement lifecycle 430, an ASIC brownout can be detected, as described herein, and the sensor can transition to the brownout handling procedure 1400. If, during the measurement lifecycle 430, the sensor 110 determines that the active mode is not the measurement mode, the sensor 110 determines that it has entered the measurement lifecycle 430 due to an unexpected error and transitions to the error termination state 650. If the communication module 140 determines a mismatch in the ASIC registers and measurement configuration information, at 1109, the communication module 140 initiates a measurement error handling procedure, such as the measurement error handling procedure described herein with respect to FIGS. 16A-16B. If the current measurement, prior to initiating a measurement sequence as described below, is not set to 0, the communication module 1110 activates an outlier filter mode. The ASIC hardware abstraction layer 200 writes the outlier command to the ASIC digital section 310 at 1112 which causes ASIC 130 to enable an outlier filter at 1112.

[0197] At 1113, the ASIC measurement sequence is initiated by the communication module 140 issuing a "start measurement" command while in measurement mode. At 1114, the ASIC hardware abstraction layer 200, writes the start measurement command to ASIC digital section 310, which in turn instructs the ASIC 130, at 1115, to start the measurement process. During the measurement process, the ASIC 130 at 1116 sets a measurement status flag to "busy" within the ASIC 130. Thus, if the ASIC 130 receives another "start measurement" command while a measurement sequence is in progress, the ASIC 130 ignores the new command. The ASIC 130 performs measurements through the AFE 139 (e.g., temperature measurements, sensor current measurements, counter potential measurements). For example, and as embodied herein, the measurement sequence can follow a set pattern of measurements progressing from one type of measurement to another in response to each received "start measurement" command. For example, a patient skin temperature measurement can precede a sensor current measurement, which can precede a counter potential measurement. Measurements can be performed in any suitable order and can be configured to facilitate efficient processing of results data. As embodied herein, the ASIC measurement sequencer can have configurable fields for determining the sample rate and number of samples permeasurement. As an example, the sample frequency can be set to one of various frequencies from about 8Hz to about 703Hz, with a preferable combination at 16Hz. Similarly, the number of samples per measurement can be set to one of various amount from about 1 sample per measurement to about 10000 samples per measurement or more, with a preferable amount of about 512 samples per measurement. For example, and without limitation, these fields can be configured at manufacture, or can be updated before use by a particular patient or while in use, e.g., by the patient or a medical professional. The configuration settings used can determine the time needed to perform a successful measurement, the resolution of the data retrieved, orthe number of discrete samples collected. After measurements are completed, the measurement data is stable and the measurement status flag is set to "idle," allowing for additional "start measurement" commands to be received. As described herein, the communication module 140, rather than the ASIC 130, can process the results data based on collected measurement.

[0198] For the purpose of illustration and not limitation, reference is made to an example embodiment of a procedure 1200 for measurement, calculation, and transmission of a single measurement for use with the disclosed subject matter as shown in FIG. 12. As embodied herein, each activity task can be performed one at a time, without overlap, and in a predefined sequence. Alternatively, activity tasks described herein can be performed in parallel or at least partially in parallel, if appropriate. The measurement cycle 1200 begins with the sensor 110 transitioning into a measurement task 1210, such as the measurement lifecycle 430. After the measurement task 1210, the sensor 110 performs an algorithm task 1220, such as analyzing the raw measurement data reported by the sensor 110 and using appropriate algorithms to calculate data relevant to the type of medical hardware 155 (e.g., calculating blood glucose levels). After the algorithm task 1220, the sensor 110 performs a data logging task 1230, such as storing the results of the algorithm task in an appropriate log to be retrieved and communicated. After the data logging task 1230, the sensor 110 performs a communication task 1240, such as communicating one or more of the results of the algorithm task to a receiver 120 or other device. As embodied herein, ASIC 130 can assume the communication module 140 can always respond to commands in time. ASIC 130 therefore assembles payload data with whatever content is available. However, in some cases the receiver 120 can lock up whena payload is received from the ASIC 130 before the receiver 120 has time to prepare a response to a previous command. As such, as embodied herein, the ASIC 130 can be prevented from sending any response if the communication module 140 cannot provide the response in time. In this manner, the receiver 120 can resend the command and avoid a lock up.

[0199] After the communication task 1240, the sensor 110 performs a result processing task 1250, such as storing the results and measurements to longer-term storage, integrating the results into trend calculations, etc. After the result processing task 1250, the sensor 110 performs a time of operation task 1260, such as increment the internally managed time of operation variable which is used to track the number of measurements made by the sensor and the amount of time the sensor 110 has been in use. For example, the sensor 110 can be configured to only perform a threshold number of measurements and measurement cycles, as the chemical processes used to measure, for example, a patient's blood glucose level, can only be stable and accurate for a certain number of measurement or amount of time. At 1270, the sensor 110 can determine if the time of operation is lower than the end- of-life (EOL) threshold. If so, the sensor 110 can return to the measurement task 1210. After the sensor 110 has completed one sequence, the sensor 110 can wait for a predefined time interval to perform the sequence 1200 again. If, however, the time of operation variable is at or has exceeded the EOL threshold, the measurement procedure 1200 can terminate.

[0200] According to other aspects of the disclosed subject matter, components and techniques for handling various error conditions that can occur during operation of the sensor 110 are described herein. Error handling techniques can include, for example and without limitation, interrupt request (IRQ) handling, brownout recovery, measurement status error handling and hardware DQ's, measurement results error handling, and application error handling.

[0201] For the purpose of illustration and not limitation, reference is made to the example embodiment of IRQ handling 1300 for use with the disclosed subject matter as shown in FIG. 13. For example, and without limitation, IRQ handling 1300 can involve handling an ASIC brownout and incoming NFC command. At 1310, the IRQ handler is invoked upon receipt of an interrupt request. The interrupt request can be prompted, for example, in response to presence of an NFC command, brownout reset, brownoutrecovery, and power supply monitor conditions, as described herein (see, e.g., FIGS. 14- 16B). As embodied herein, the flags for the power supply being low or returning high again and NFC command can be masked by a mask register, thus the IRQ line will not be raised by the masked diagnostic and corresponding IRQ status registers won't be set. Additionally, or alternatively, masking the interrupt triggers can also prevent the IRQ line from being pulled high while allowing their corresponding IRQ status registers to be set.

[0202] At 1320, the sensor 110 evaluates signals sent through the IRQ pull-up. For example, the IRQ pull-up can evaluate certain registers and determine whether flags for communication errors and indication of a brownout event. If there is a brownout event, at 1350, the brownout handling procedure, described herein, is invoked. After 1350, at 1360, the next measurement is disqualified. The IRQ handling method 1300 then terminates. If at 1320, the registers indicate that an NFC command has been initiated (e.g., if an NFC field has been brought into communicative range of the ASIC 130), at 1330, the procedure to handle NFC commands, described herein, is invoked. After the NFC command is handled, at 1340, the pending NFC command register is cleared. IRQ handling 1300 then terminates.

[0203] A drop in battery voltage below a specified reset threshold can cause the ASIC 130 to assert the IRQ, causing IRQ handling 1300 to be initiated. In this state, the ASIC 130 is in reset and will not respond to commands. A brownout is defined as a short interruption in the battery supply voltage, VBAT. The duration of the brownout is defined as the time between VBATgoing below the reset threshold and VBATreturning above the release threshold. The brownout duration that the ASIC 130 is able to recover from can vary based at least in part on the lowest level of VBATexperienced during the brownout event.

[0204] For the purpose of illustration only, example techniques for brownout recovery are illustrated and described with reference to the chart shown in FIG. 14. The chart 1400 illustrates a chart having two axes, a vertical axis, marked VBATcorresponds to the battery supply voltage received by the ASIC 130, and a horizontal axis, marked brownout time corresponds to the amount of time elapsed. The VBATaxis includes a plurality of demarcated points. A first point, Vth off, corresponds to a defined threshold for determining whether a drop in battery supply voltage is a significant drop. For example, the threshold can be defined as a percentage of the nominal supply voltage (e.g., 40%, 50%, 60%, etc.). A second point on the axis, Vth reset, corresponds to a defined thresholdfor determining whether a sufficient amount of the battery supply voltage has returned to allow for a brownout recovery in certain instances. Along the brownout time axis, a single point is marked, Tbrownout tbresbold, corresponding to the amount of time for the ASIC 130 to experience a brownout before the risk of recovery is greater than a predetermined tolerance. The relationship of these thresholds on the axes creates a number of zones, 1410, 1420, 1430, and 1440 that define the potential behavior of the ASIC 130 in response to the brownout. Zone 1410 corresponds to normal operations, where the battery supply voltage can fluctuate, but does not drop below Vtb off. In the zone of operation 1410, the AISC will recover from a brownout event independent of the brownout duration. Zone 1420 corresponds to the battery supply voltage dropping below Vtb offfor a duration less than the Tbrownout tbresbold. In the zone of operation 1420, the ASIC will recover as described herein. Zone 1430, for clarity, corresponds to instances in which the ASIC 130 is already in storage mode 710, which reduces the draw on the battery supply voltage level until a wake command is received. Finally, zone 1440 corresponds to the battery supply voltage level dropping below Vtb offfor a duration greater than the Tbrownoutthreshold- Zone 1440 can be considered an undefined environment, where the ASIC 130 can recover or cannot, in which case, the ASIC 130 goes into a forced storage mode to protect measurement data.

[0205] For purpose of illustration and not limitation, reference is made to the example embodiment of a procedure for the brownout handling 1350 for use with the disclosed subject matter as shown in FIGS. 15A-B. Brownout handling 1350 can be used, for purpose of illustration and not limitation, to handle brownouts that can occur while the communication module 140 is in a sleep mode. At 1501, the ASIC 130 indicates to the communication module 140 that an IRQ has been received and must be handled. For example, the ASIC 130 can set a value on a designated register of the ASIC 130, which is read by the communication module 140. At 1502, if needed, the ASIC 130 also sends a wake command to the communication module 140. At 1503, the communication module 140 reads the IRQ status from the appropriate registers of the ASIC 130. At 1504, the ASIC 130 sends the IRQ status data to the communication module. If the IRQ status indicates that the IRQ is the result of a communication error (e.g., not a brownout event), at 1505, the communication module 140 initiates a timer associated with a threshold recovery time. The threshold recovery time (e.g., 10ms + / - 2ms) can be selected and used to avoidunnecessarily causing error termination. If the ASIC 130 fails to recover in the threshold amount of time, the sensor 110 proceeds to the error termination state 650. If the ASIC 130 recovers in the threshold amount of time, at 1506, the ASIC modifies the IRQ to indicate that it has recovered. The ASIC 130, at 1507, triggers a connection request with the communication module and, at 1508, again modifies the IRQ. The ASIC 130 then proceeds to perform the activation sequence 730 described herein to refresh itself. At 1509, the communication module reads the IRQ status from the appropriate registers of the ASIC 130. At 1510, the ASIC 130 sends the IRQ status data to the communication module 140. At 1511, the communication module 140 clears the brownout flag, which can have been set during the activation sequence or prior to the IRQ being received by the ASIC 130. At 1512, the ASIC 130 resets the IRQ. The sensor 110 then causes the ASIC 130 to be re- initialized so that the sensor 110 can fully recover.

[0206] Referring now to FIG. 15B, if, after 1504, the communication module 140 determines that the IRQ was the result of a brownout event, the ASIC 130 is set to state 730 where it performs the activation sequence. Then, at 1513, the communication module clears the flag corresponding to the brownout event. In response, at 1514, the ASIC 130 modifies the IRQ register to indicate that the flag has been cleared. Then, the sensor 110 causes the ASIC 130 to be re-initialized so that the ASIC 130 can recover. The ASIC 130 is then set to the measurement mode state 760.

[0207] In addition or as an alternative to interrupt requests, the sensor 110 can be configured to handle diagnostics and measurement errors during operation. Diagnostics can be organized in three categories. Runtime diagnostics occur throughout the operating period and include cyclic testing done for each measurement cycle. For example, and without limitation, runtime diagnostics can include real-time monitoring of the power supply. Startup diagnostics can occur relatively infrequently, for example when the sensor 110 is activated or shortly after activation. Manufacturing diagnostics, conducted during manufacturing, can confirm, for example and without limitation, that the sensor 110 is built correctly, does not have failed or missing components, and / or is calibrated according to set threshold ranges.

[0208] Runtime diagnostics include measurement diagnostics. In embodiments described herein, if a runtime diagnostic fails, the corresponding data associated with a diagnostic failure is marked with a data quality error code and can be set aside and notused for calculations. As examples only, data quality error codes can be assigned to represent, for example and without limitation: if the ASIC 130 detects a low battery supply voltage during measurement; if the measurement is above or below an outlier threshold; if an NFC field is detected while in measurement mode; if a brownout is detected during measurement; if ASIC 130 registers or measurement configuration values mismatch; if a voltage associated with the medical hardware 155 is outside of normal operating ranges; if an insertion failure is detected; and for other related occurrences. Responses to detecting a data quality error code can include rejecting current measurement data, rejecting measurement data for one or more future measurement cycles, or rejecting measurement data until the data quality error code is affirmatively removed by the sensor 110.

[0209] Runtime diagnostics further include additional runtime diagnostics associated with the ASIC 130, some of which are referenced in the discussion above. These runtime diagnostics include the detection of an NFC field while the ASIC 130 is in the measurement mode state 760. The detection of an NFC field sets a flag for use by the sensor 110 which can be cleared at the start of a new measurement. The ASIC 130 further includes a power supply monitor 137 that monitors voltage levels along various connections between the battery 150 and the ASIC 130. These connections include the power supplied via an NFC RF field, the standard supply from the battery 150, and the inverting charge pump supply. The power supply monitor 137 can set a flag indicating the drop in power and a return to the power, which can include asserting an interrupt request. The ASIC 130 can include an external thermistorto act as a temperature monitor to determine if the current temperature is outside of the operating temperature range of the ASIC 130. If the temperature is outside of the target range, a flag can be set to potentially cause the ASIC 130 to cease operation to preserve the ASIC 130 and battery 150.

[0210] Additionally, or alternatively, diagnostics can be derived based on the analog front end 139 of the ASIC 130 monitoring the current and voltage read from various electrodes of the medical hardware 155 (e.g., sensor hardware or an analyte sensor). FIG. 23 illustrates an example diagram 2300 of the analog front end 139 illustrating functions for the analog front end 139 between the analyte sensor 2310 (e.g., sensor hardware) and the PCB 2320 of the sensor 110. As embodied herein, FIG. 23 illustrates the workingelectrode 2312 (WRK), reference electrode 2314 (REF), and counter electrode 2316 (CTR), with the analyte sensing element 2318 between the working electrode 2312 and reference electrode 2314. The counter electrode is driven with a bandgap reference voltage Vbgby the analog front end 139 which is then adjusted before being provided to the reference electrode 2314. The analyte sensing element 2318 provides additional voltage to the working electrode 2312. The difference between the voltage at the working electrode 2312 and the voltage at the reference electrode 2314, referred to as the poise voltage, is used to determine the amount of analyte present. The voltage at the reference electrode 2314 is also monitored. Between each of the working electrode 2312, reference electrode 2314, and counter electrode 2316 can be one or more additional sources of resistance (not illustrated) such as the resistance of the trace that connects the sensor electrodes to the connection point with the sensor connector and the resistance from the PCB connector to the electronics. The PCB can include a transimpedance amplifier 2322 which can include a programmable offset from the bandgap reference voltage Vbg. The transimpedance amplifier can convert the current signal from the working electrode into voltage at output, however, the common mode voltage (e.g., WRK) is typically removed to determine the true measurement. In alternative embodiments, a difference amplifier 2600, such as that illustrated in FIG. 26 can be used. Note that with the difference amplifier 2600 precise matching between the resistors is often needed.

[0211] In an alternative embodiment, the sensor 110 can include multiple working electrodes. FIG. 25 illustrates an example of a configuration of the sensor 110. As embodied herein, FIG. 25 illustrates an example circuit 2500 including an analyte sensor 2510 with a first working electrode current 2511 (WRK_1) and a second working electrode current (2512 (WRK_2). The analyte sensor 2510 further includes a reference electrode 2514 (REF) and counter electrode 2516 (CTR) similarly situated as in the analyte sensor 2310. The current from each of the working electrodes can be fed to a transimpedance amplifier 2522 and 2523, as illustrated in FIG. 23. Each transimpedance amplifier can include an independently programmable offset from the bandgap reference voltage Vbg. The transimpedance amplifiers can convert the current signal from the working electrode into voltage at output. In alternative embodiments, a differenceamplifier, such as at illustrated in FIG. 26 can be used; however, the common mode voltage (e.g., WRK) is typically removed to determine the true measurement. In alternative embodiments, one or more difference amplifiers, such as the difference amplifier 2600 illustrated in FIG. 26 can be used.

[0212] As embodied herein, the analog front end 139 can be configured to monitor the current and voltage from at least the working electrode (e.g., working electrode 2312) and counter electrode (e.g., counter electrode 2316). The analog front end 139 can monitor for a low working current. The analog front end 139 or ASIC 130 can be configured with a minimum working current threshold required for the sensor 110 to continue to operate after an analyte sensor has been inserted into a patient. Additionally, the analog front end 139 can particularly monitor for a low working current for a predefined period of time after user insertion of the sensor. In addition to monitoring the working current for the minimum working current threshold, the analog front end 139 and ASIC 130 can monitor for working current values within a threshold range of a target working current value. The analog front end 139 can further monitor for a high working current. The analog front end 139 or ASIC 130 can be configured with a maximum working current threshold that corresponds to a value below analyte sensor saturation, the point at which sensor values cannot be taken as accurate. The analog front end 139 can further monitor for a low counter electrode voltage. In particular, the analyte sensor voltage between the working electrode and counter electrode can be maintained by a servo amplifier that adjusts the voltage at the counter electrode, for example, in response to negative feedback from a reference electrode. As the conditions of the analyte sensor change, the counter electrode voltage automatically adjusts to maintain the reference voltage at a predetermined amount, which can be used to maintain the target poise voltage within a suitable range. The analog front end 139 or ASIC 130 can be configured with a minimum counter voltage threshold required for the analyte sensor to continue to operate properly. The analog front end 139 can further monitor for a high counter electrode voltage. In particular, because the analyte sensor works in part by measuring voltage differences between the working electrode and counter electrode, for the analyte sensor to function properly, the voltage from the counter electrode can be no higher than the working electrode. The analog front end 139 or ASIC 130 can be configured with an appropriate maximum counter voltage threshold. These analog frontend diagnostic checks can be used to assess analyte sensor failure modes, including sensor connection problems.

[0213] The poise voltage can be maintained using a hardware-enforced or programmable poise voltage source. The purpose of the programmable poise voltage source is to bias the difference between the voltage at working electrodes and reference electrodes to ensure that the measurement range is within a target range that is suitable for analyte measurement. To change the poise voltage with a hardware-enforced poise voltage source, the resistor networks that set the poise voltage had to be recalculated to the new intended poise voltage and change. As such, to change the poise voltage, the board is disassembled and the resistors swapped out for new values, which can be inconvenient, for example if resistors having suitable values are unavailable. A programmable poise voltage thus allows for the sensitivity analyte sensor to be adjusted according to developing conditions over the lifespan of the analyte sensor. For example, the circuit which generates the poise voltage can be controlled by a microprocessor which can set the poise voltage by outputting the necessary voltage via the DAC pin of the microprocessor. This allows for fast and automated calibration of the poise voltage. DAC settings can be optimized with software routines and stored for later usage.

[0214] FIG. 27 illustrates an example circuit that can be used as a variable floating poise voltage generator. The circuit 2700 as shown in FIG. 27 uses four resistors 2711, 2712, 2713, and 2714, an N-channel MOSFET 2720, and two op-amps 2731 and 2732, one acting as a current source 2731 and the other acting as an inverting amplifier 2732. The poise voltage is set with the DAC1 2741 and DAC2 2742 pins from the microprocessor. Op-amp 2732 will invert the voltage from DAC2 2742 into a voltage equal to the negative of DAC2 2742. Op-amp 2731 is configured as a current source that is programmed with the positive input of the op-amp. The difference between "poise high" 2751 and "poise low" 2752 is the poise voltage and is controlled by the current flowing through resistor 2711 (as illustrated in FIG. 28). The voltage at "Poise High" 2752 is driven by an amplifier shown in FIG. 28 that also controls the voltage at the working electrode of the sensor. The opamp 2731 and MOSFET 2720 will control the voltage at 2760 so that it is equal to the voltage at 2761. The voltage across resistor 2712 is controlled by the settings for DAC1 2711 and DAC2 2712. The current flowing through resistor 2712 is the same as the current flowing through resistor 2711. In this way the poise voltage can be controlledindependent of the voltage at WRK. With this circuit, if the voltage at WRK is required to change due to change in sensor current the poise voltage will remain unchanged even as the voltage at WRK changes.

[0215] FIG. 28 illustrates an example configuration of a sensor in a measurement configuration with a floating variable poise voltage circuit (e.g., the circuit 2700). The poise voltage is measured from the WRK electrode and the REF electrode and will be equal to the voltage measured from Poise High and Poise Low. The analyte sensor 2710 is a sensor, as described herein, with chemistry to react to the analyte sensor during use.

[0216] FIG. 29 illustrates an example configuration 2900 of a sensor in a calibration configuration with a floating variable poise voltage circuit (e.g., the circuit 2700). During calibration a simulated analyte sensor 2910 can be used with two resists 2911 and 2912 as shown in FIG. 29. A digital voltmeter (DVM) 2920 will measure the voltage between WRK and REF and feedback the measurement to the microprocessor 2930 to adjust DAC1 and DAC2 and get the poise voltage to the desired value. In the sensor measurement configuration, the poise voltage will have previously been set during calibration and the WRK op-amp will provide the current across resistor 2711 of FIG. 27.

[0217] When an analyte sensor 2810 is attached to the circuit 2800 in FIG. 28, the sensor portion connected between the WRK 2821 and REF 2822 will generate a current when it comes in contact with the analyte. The variable poise voltage can allow the sensor to detect a variety of analytes, by adjusting the reactive current in both positive and negative domains. The current will flow down through ZCTR2831 and Rmeas2832. The voltage at the CTR electrode 2823 will vary depending on the current generated by the analyte sensor 2810 and therefore the voltage at the REF electrode 2822 will vary according to the current going through Rmeas2832 and ZCTR2831. It is for this reason that a floating poise voltage is needed. The feedback loop of the REF op-amp 2842 includes the WRK op-amp 2842 and resistor 2711. The voltage output of the REF op-amp 2842 goes to the positive terminal of the WRK op-amp 2841 which will cause the output to adjust the negative terminal of the WRK op-amp 2841 to match the positive terminal, the feedback loop of the REF op- amp 2842 continues through resistor 2711, which will have voltage equal to the digitally set poise voltage. It is due to this feedback loop that the voltage at the REF electrode 2822and WRK electrode 2821 will differ by the voltageacross resistor 2711, which is the poise voltage set and calibrated by the microprocessor 2850.

[0218] FIG. 30 illustrates an alternative configuration of the floating variable poise voltage circuit 3000. The circuit includes three single-supply operational amplifiers or opamps 3010, 3011, and 3012, one NMOS transistor 3020, one PMOS transistor 3025, one capacitor 3030, and three resistors 3040, 3041, and 3042. Note that the label WRK, as is used throughout this disclosure and the accompanying drawings, refers to the location with the working terminal is located. The label REF is where the reference terminal connects. DAC1 3051 and DAC2 3052 denote two DAC outputs from either a microcontroller or standalone DAC components. For the sensor to work properly, it is important that no current flows through the REF terminal. Therefore, connecting REF to the non-inverting input of op-amp 3011 ensures a high impedance node at that terminal. In steady state operation, op-amp 3012's inverting input will match the voltage at REF. As a result, the voltage across resistor 3041 becomes the poise voltage. The circuit configuration of op- amp 3012, resistor 3041 and capacitor 3030 is also known as a transimpedance amplifier, which converts current into voltage. A bidirectional current source, which includes op-amp 3010, op-amp 3011, NMOS transistor 3020, PMOS transistor 3025, resistor 3040, and resistor 3042 generates a current that is determined by the values at DAC1 3051 and DAC2 3052. When this current flows through resistor 3041, the poise voltage is formed between WRK and REF. In other words, the poise voltage is linearly proportional to the current generated by the bidirectional current source. To generate a positive poise voltage DAC1 3051 will be set to VDD (e.g., 3V) to turn off PMOS transistor 3025. Op-amp 3010 will drive NMOS transistor 3020 to generate an average current equivalent to about the value at DAC2 3052 divided by the value at resistor 3040. The same current flows through the resistor 3041 and thus the poise voltage is equal to the value at DAC2 3052 divided by the product of the value at resistor 3041 and 3040. On the other hand, if a negative poise voltage is desired, the DAC2 3052 is set to 0V so NMOS transistor 3020 will be turned off. The current generated in this case is equal to VDD minus the value at DAC1 3051 divided by the value at resistor 3042. This time, the generated current will flow through resistor 3041 in the opposite direction, and thus produce a negative poise voltage. Now, the REF voltage is higher than WRK voltage.

[0219] FIGS. 31-34 illustrate various alternative configurations of the floating variable poise voltage circuit. The circuit 3100 illustrated in FIG. 31 includes a four single-supply op-amps 3110, 3111, 3112, and 3113, four resistors 3120, 3121, 3122, and 3123, two capacitors 3130 and 3131, and two transistors 3140 and 3141. Op-amp 3110, resistor 3120, and capacitor 3130 are configured in a first transimpedance amplifier, while opamp 3111, resistor 3121, and capacitor 3131 are configured in a second transimpedance amplifier. This configuration ensures minimal leakage at the REF terminal due to the high impedance. Resistors 3122 and 3123 can be either a programmable DAC source, as discussed herein, or can be external resistors. Note that this configuration can generate only a poise voltage with positive polarity.

[0220] The circuit 3200 illustrated in FIG. 32 includes one op-amp 3210, two resistors 3220 and 3221, DAC sources 3230, 3231, and 3232. One DAC source 3232 biases the REF terminal. DAC source 3231 biases the WRK terminal. This DAC source 3231 can be varied above or below the REF voltage to achieve positive and negative poise voltages using the techniques described herein. This configuration has a smaller component count than some of the other configurations, but in this configuration the WRK terminal voltage cannot track variation at the REF terminal which can impact sensor accuracy.

[0221] The circuit 3300 illustrated in FIG. 33 includes two op-amps 3310 and 3311, two resistors 3320 and 3321, a capacitor 3330, a transistor 3340, and a multiplexer / demultiplexer 3350. With the multiplexer / demultiplexer 3350, the WRK and REF terminals can be programmatically swapped to generate poise voltage with dual polarities. Vref3355 can refer to either a DAC output or a voltage reference (e.g., with an external resistor to vary the poise voltage). This configuration includes more components and can increase power consumption and increase risk of leakage.

[0222] The circuit 3400 illustrated in FIG. 34 includes an op-amp 3410, resistors 3412 and 3411 and features the REF terminal 3420 with a negative gain. In this case the current at the WRK terminal is equivalent to the current at the REF terminal plus double the Vref. Note that this configuration, while simple, has low impedance at the REF terminal. Therefore, current flow can result in inaccurate measurements.

[0223] An outlier filter can be integrated into a digital signals processing module of the ASIC 130 and can be used to monitor a pending measurement before the results are processed. The outlier filter can compare a current result to results in the recent past (eg., an immediately previous result) by comparing the pending result to the result to be reported from the last cycle. If the current result is identified as an outlier (e.g., for deviating from the previous result) the result is removed. As an example, the result to be reported from a cycle with an outlier can be replaced with the previous result, written over by a new measurement, or replaced with a default value that indicates that there was an outlier error. The number of outliers recorded for each measurement cycle can be stored and retrieved during measurement processing. Outliers can be reported for each sample, where a measurement includes a combination of multiple samples. The digital signals processing module of the ASIC 130 can also include an averaging filter that calculates the average of all samples from a single measurement sequence.

[0224] FIG. 1 furthermore depicts a conceptual representation of a magnetic field 181, which may comprise a dynamic magnetic field with oscillating or changing characteristics. The magnetic field 181 can oscillate with a frequency or range of frequencies (e.g., within a range of about 9 kHz to about 13.56 MHz). The magnetic field 181 may be emitted or produced by various types of components, such as switching power supplies, variable frequency drives, digital communication systems, switching digital logic circuits, AC wiring, transformers, solenoids, and / or others. Such components can be implemented in various types of devices, such as wireless power transmission systems (e.g., wireless charging systems), position detection devices, RFID transponders and readers, induction cooking appliances and ovens, lighting systems, electric motors, smart home devices, wireless communication equipment, and / or others.

[0225] Components of a system 100 as described herein can enter a magnetic field 181 generated by such devices. For instance, while worn by a user (e.g., as an on-body unit or on-body sensor) a sensor 110 may come into close proximity to a device that emits a magnetic field 181 (e.g., a wireless charging device), which may cause magnetic interference in signals associated with the sensor 110. The magnetic interference may manifest as signal noise, disturbance, or disruption, which can affect signal or data values that are received, processed, or output by components of the sensor 110. By way of example, when the system 100 is used for CGM, such magnetic interference can affect the raw / analog signals output by the sensor hardware (of the medical hardware 155) and / or received by the ASIC 130 of the sensor 110, or can affect the digital measurements or measurement signals created by the ASIC 130 based on the raw / analog signal, or canaffect glucose values (e.g., glucose values measured from interstitial fluid, which is correlated with blood glucose values), trends, actionable responses, or other information determined by the communication module 140 (or receivers 120, 176, 178) based on the digital measurements or measurement signals.

[0226] Medical sensor systems (e.g., system 100) and / or components thereof are expected to regularly encounter magnetic fields with particular frequency characteristics, in part because production of such magnetic fields is expected to become more prevalent in consumer and / or commercial devices. For instance, the International Electrotechnical Commission (IEC) has indicated in IEC 60601-1-2 4th edition (section 8.11) that medical electrical equipment / devices should maintain functionality after entering magnetic fields in the frequency range of 9 kHz to 13.56 MHz. It has been found that some frequencies within this range, such as 134.2 kHz, can present particular challenges for medical monitoring systems and / or components thereof (e.g., system 100 and / or components thereof).

[0227] As noted hereinabove, at least some disclosed embodiments provide systems, devices, and techniques that can enable components of medical monitoring systems 100 to maintain functionality after exposure to certain magnetic fields, such as magnetic fields with a frequency of about 134.2 kHz (or within a range of about 130 kHz to about 140 kHz, or preferably within a range of about 15 kHz to about 300 kHz). Various examples provided herein describe magnetic interference as comprising or being associated with one or more particular frequencies, indicating that the magnetic interference (e.g., signal noise, disruption, or disturbance) is caused by one or more magnetic fields of the particular frequency / frequencies. Various examples provided herein refer to a "magnetic interference signal," which comprises a magnetic field (or a measurement signal representative of a magnetic field) capable of causing magnetic interference in electronic components / devices.

[0228] Although various examples described herein may focus, in at least some respects, on mitigating magnetic interference associated with particular frequencies or frequency ranges, the principles described herein may be applied to other frequency ranges not specifically recited herein. Furthermore, although various features, structures, or techniques provided herein are discussed as being implemented in conjunction with a particular component (e.g., an ASIC of a medical sensor), such features, structures, ortechniques may be implemented in conjunction with other devices (e.g., a communication module or other component of a sensor or receiver, or other type of device such as blood glucose meter or other type of medical monitoring device). Still furthermore, the various components and / or techniques described herein for facilitating mitigation of magnetic interference in medical monitoring systems may be combined in certain devices, or may be implemented individually. For instance, a sensor may implement a measurement disqualification system and / or magnetic interference filter to enable magnetic interference mitigation.

[0229] As noted above with reference to FIG. 1 FIG. 23, and FIG. 25, an ASIC 130 of a sensor 110 of a medical monitoring system 100 can be coupled to sensor hardware, such as electrodes of an analyte sensor (e.g., medical hardware 155). For instance, the ASIC 130 may comprise an analog front-end (AFE) 139, which may enable the ASIC 130 to receive analog or raw measurement signals from sensor hardware comprising a working electrode (WRK), a reference electrode (REF), and / or a counter electrode (CTR) (see FIG. 23), and / or from multiple working electrodes (see FIG. 25, providing WRK_1, WRK_2, etc.). The ASIC 130 may provide an output signal (e.g., digital measurements) based on the measurement signals received from the sensor hardware, such as by processing the received measurement signals using analog-to-digital converter (ADC) circuitry (and / or other components, such as a transimpedance amplifier upstream of the ADC). The output signal of the ASIC 130 may be further processed by the communication module 140 (or another device) to generate an output data, such as analyte measurement data (or "medical measurement data" or simply "measurement data"), analyte levels (e.g., glucose levels), trends, actionable responses, etc. The communication module 140 may communicate the output data to one or more external devices, such as one or more of the receivers 120, 176, and 178 of the set of receivers 172.

[0230] FIG. 1 illustrates that the ASIC 130 can include various components configured to facilitate mitigation of the effects of magnetic interference on the measurement signals (e.g., obtained by the sensor hardware and / or received by the ASIC 130 via the AFE 139), the output signals (e.g., generated by processing of the measurement signals by the ASIC 130), and / or the output data (e.g., generated by processing of the output signals by the communication module 140). For instance, FIG. 1 illustrates that the ASIC may include amagnetic interference filter 132, a magnetic interference detection element 136, and / or a multi-band antenna 138, which will be described in more detail hereinbelow.

[0231] The magnetic interference filter 132 can be configured to filter magnetic interference in the measurement signal generated by the sensor hardware. For instance, when the sensor 110 is in proximity to the magnetic field 181, the magnetic field 181 may cause magnetic interference in the raw or analog signal generated by the work electrode (WRK), the reference electrode (REF), and / or the counter electrode (CTR) (see FIG. 23), and / or any of multiple working electrodes (see FIG. 25). The magnetic interference may be associated with various frequencies, such as frequencies within a range of about 15 kHz to about 300 kHz (or more particularly within a range of about 130 kHz to about 140 kHz). The magnetic interference filter 132 may filter the magnetic interference from the raw or analog signal generated by the work electrode (WRK), the reference electrode (REF), and / or the counter electrode (CTR) (see FIG. 23).

[0232] The magnetic interference filter 132 can be configured as an electromagnetic compatibility (EMC) filter and can be configured to intervene between the sensor hardware (e.g., the medical hardware 155) and the ASIC 130. In some For instance, the magnetic interference filter 132 may be electrically connected to the work electrode (WRK), the reference electrode (REF), and / or the counter electrode (CTR) (see FIG. 23), such that filtering of the measurement signal(s) obtained via the electrode(s) is performed prior to processing of the measurement signal(s) by the ASIC 130 (e.g., to create an output signal or digital measurements). A magnetic interference filter 132 may additionally or alternatively be positioned at multiple work electrodes (see FIG. 25) and / or anywhere along a measurement signal chain or circuitry. Although described herein in conjunction with the ASIC 130, a magnetic interference filter 132 can be implemented on other componentry of a medical monitoring system 100 (e.g., on internal wiring, on one or more components of a communication module 140, on one or more components of a receiver of the set of receivers 172, etc.).

[0233] FIG. 45 illustrates a diagram 4500 showing example aspects of a magnetic interference filter 4502, which corresponds to the magnetic interference filter 132 described hereinabove. In the example of FIG. 45, the magnetic interference filter 4502 is connected to the work node 4504 (WRK) of sensor / medical hardware 155 (which may be connected to or comprise the work electrode / connection / channel described herein).In this way, the measurement signal obtained via the work node 4504 (WRK) may be filtered prior to processing of the measurement signal by the ASIC 130. As noted above, although FIG. 45 shows the magnetic interference filter 4502 as being connected to the work node 4504, a magnetic interference element may additionally or alternatively be connected to a reference node and / or a counter node (corresponding or connected to the reference electrode / connection / channel and the counter electrode / connection / channel, respectively). FIG. 45 illustrates the magnetic interference filter as including a resistive element 4506 and a capacitive element 4508, which may be tuned to enable the magnetic interference filter 4502 to filter the measurement signal obtained via the work node 4504 (WRK). For instance, the resistive element 4506 may comprise a resistance within a range of about IK Ohms to about 100K Ohms, or a range of about 23K Ohms to about 43K Ohms, or a range of about 28K Ohms to about 38K Ohms, or a range of about 30K Ohms to about 36K Ohms, or a range of about 32K Ohms to about 35K Ohms, or about 33K Ohms. As another example, the capacitive element 4508 may comprise a capacitance within a range of about 1 pF to about 1 nF, or a range of about 17 pF to about 37 pF, or a range of about 22 pF to about 32 pF, or a range of about 24 pF to about 30 pF, or a range of about 26 pF to about 28 pF, or about 27 pF. In some implementations, the resistance and the capacitance values for the resistive element and the capacitive element, respectively, are selected such that the cutoff for the selected values is within a range of about 15 kHz to about 300 kHz (e.g., where 1 / (2TT7?C’) = desired range, and where R corresponds to the resistance value, C corresponds to the capacitance value, and the desired range corresponds to a range of about 200 kHz to about 300 kHz). Although FIG. 45 focuses on an example in which the magnetic interference filter 4502 is connected to the work node 4504, as noted above, a magnetic interference filter may be connected to multiple work nodes, a reference node, a counter node, and / or any part of a measurement signal chain.

[0234] The magnetic interference detection element 136 of the ASIC 130, as shown in FIG. 1, can be configured to indicate when magnetic interference is represented in the measurement signal generated by the sensor hardware. For instance, when the sensor 110 is in proximity to the magnetic field 181, the magnetic field 181 may cause magnetic interference in the raw or analog signal generated by the work electrode (WRK), the reference electrode (REF), and / or the counter electrode (CTR) (see FIG. 23). The magneticinterference may be associated with various frequencies, such as frequencies within a range of about 15 kHz to about 300 kHz (or more particularly within a range of about 130 kHz to about 140 kHz). The magnetic interference detection element 136 may detect when the magnetic interference is represented in the raw or analog signal generated by the work electrode (WRK), the reference electrode (REF), and / or the counter electrode (CTR) (see FIG. 23).

[0235] FIG. 46 illustrates a diagram 4600 illustrating example aspects of a magnetic interference detection element 136 described hereinabove. Element 4602 of diagram 4600 indicates that the magnetic interference detection element 136 can be implemented, via an electrical connection, at the work node (WRK, which may be connected to or comprise the work electrode / connection / channel described herein), the reference node (REF, which may be connected to or comprise the reference electrode / connection / channel described herein), and / or the counter electrode (CTR, which may be connected to or comprise the counter electrode / connection / channel described herein). Although element 4602 indicates that the magnetic interference detection element 136 can be implemented at the work node, the reference node, or the counter node, a magnetic interference detection element may additionally or alternatively be connected to other components of a medical monitoring system 100 (e.g., to internal wiring, to other components of the ASIC 130, to one or more components of a communication module 140, to one or more components of a receiver of the set of receivers 172, etc.).

[0236] Element 4604 of diagram 4600 indicates that the magnetic interference detection element 136 can include a high input impedance buffer connected to the work node, the reference node, and / or the counter node. The high input impedance buffer can minimize the current drawn by the magnetic interference detection element 136 from the work node, the reference node, and / or the counter node. The high input impedance buffer can thus advantageously minimize signal distortion caused by implementing the magnetic interference detection element 136 in conjunction with the ASIC 130.

[0237] Element 4606 of diagram 4600 indicates that the magnetic interference detection element 136 can include a narrow band filter connected to the high input impedance buffer. The narrow band filter may be tuned to detect frequency signals or noise (e.g., indicative of magnetic interference) associated with a particular frequency range in themeasurement signal(s) of with the work, reference, and / or counter node. For instance, the narrow band filter may be configured to detect frequency signals or noise (e.g., indicative of magnetic interference) associated with a frequency range of about 15 kHz to about 300 kHz (or another range).

[0238] Element 4608 of diagram 4600 indicates that the magnetic interference detection element 136 can include a rectifier connected to the narrow band filter. The rectifier can convert the AC signal of the narrow band filter into a DC signal. Element 4610 of diagram 4600 indicates that the magnetic interference detection element 136 can include a comparator that compares the DC signal of the rectifier to a reference signal to determine whether the DC signal indicates the presence of magnetic interference. The comparator may output a digital signal with two possible states, with one state indicating that the DC signal of the rectifier indicates the presence of magnetic interference, and with the other state indicating an absence of magnetic interference in the DC signal of the rectifier.

[0239] Element 4612 of diagram 4600 indicates that the magnetic interference detection element 136 can include digital logic that receives the state output of the comparator. The digital logic may cause the magnetic interference detection element 136 to take different actions based upon whether the state output of the comparator indicates the presence of magnetic interference in the measurement signal(s) obtained via the work, reference, and / or counter nodes. For instance, when the state output of the comparator indicates that magnetic interference is present in the measurement signal(s), the digital logic may trigger or set a disqualification flag ("DQflag"), as indicated in diagram 4600 by element 4614. The disqualification flag may cause disqualification of the measurement signal(s) associated with the work node, the reference node, and / or the counter node. The disqualification flag may additionally or alternatively cause disqualification of output signals generated at the ASIC 130 based on measurement signals of sensor hardware, or may cause disqualification of output data generated by the communication module 140 (or another device).

[0240] Disqualification of measurement signals, output signals, or output data based on a disqualification flag can take on various forms. For instance, the disqualification flag triggered or set by the digital logic may comprise a disqualification bit that is set in association with the measurement signals, the output signals, or the output data. The presence of the disqualification bit may trigger various actions by the sensor 110 and / orother devices such as receivers of the set of receivers 172. For instance, the presence of the disqualification bit may cause the sensor 110 and / or other devices to refrain from utilizing the associated measurement signals (or derivatives thereof such as output signals or output data as described herein) in determining analyte levels, trends, or other information about the user wearing the sensor 110. The presence of the disqualification bit can cause components (e.g., the ASIC 130, the communication module 140, receivers, etc.) to refrain from processing or sending measurement signals, output signals, or output data, or may cause components to refrain from utilizing received measurement signals, output signals, or output data (e.g., to determine output information for presentation to or association with users). In some instances, the presence of the disqualification bit may trigger magnetic interference compensation operations to compensate for the magnetic interference in the measurement signals, the output signals, or the output data. In some instances, the presence of the disqualification bit may trigger clearing of signals or data or may trigger processor interrupts, which may cause the system 100 to refrain from acquiring signals and / or data.

[0241] The magnetic interference detection element 136 may continuously monitor the measurement signals of the work, reference, or counter nodes to determine whether magnetic interference remains present or whether magnetic interference is no longer present. If magnetic interference is determined to be no longer present in the measurement signals, the magnetic interference detection element 136 may refrain from triggering or setting the disqualification flag, which may enable the components of the system 100 to continue to gather and process measurement data to provide medical monitoring functionality.

[0242] FIG. 47 illustrates a diagram 4700 illustrating example aspects of a magnetic interference detection element 136 described hereinabove. Element 4702 of diagram 4700 represents a sensor data signal obtained by the sensor 110, such as the measurement signal obtained via the medical / sensor hardware 155. As depicted in FIG. 47, the sensor data signal may be processed by a transimpedance amplifier (TIA), represented by element 4704, the output of which may be processed by an analog-to- digital converter (ADC), represented by element 4706. The output of the ADC may be stored in a sensor data buffer, represented by element 4708 in FIG. 47. For instance, the sensor data buffer may store output signals (output by the ADC) based on themeasurement signal (measured by the medical / sensor hardware 155), and the output signals stored in the sensor data buffer may be used to generate analyte measurement data (e.g., output data), which may occur on-sensor or off-sensor. The sensor data buffer may store output signals and / or other data based on the sensor data / measurement signal for any desired time period.

[0243] FIG. 47 also depicts the sensor data signal being processed by other componentry to facilitate detection of whether magnetic interference is present. In particular, FIG. 47 depicts the magnetic interference detection element 136 as including a peak detector, represented by element 4710, and a low pass filter, represented by element 4712. The peak detector can be configured to identify and / or hold the maximum or peak value of an input signal (e.g., the sensor data signal) over a specific period of time. In some implementations, the peak detector used in the magnetic interference detection element 136 comprises an analog peak detector, which may include one or more diodes, capacitors, resistors, and / or other components. As noted above, magnetic interference, when present, can manifest in the sensor data signal as high-amplitude noise. By holding the maximum or peak value of the sensor data signal, magnetic interference, if present, can manifest in the output of the peak detector. The output of the peak detector is labeled as signal "A" in FIG. 47 (e.g., a voltage signal). Although the example shown in FIG. 47 implements a "peak detector", other types of circuits may be used in accordance with the disclosed principles, such as envelope detectors, sample-and-hold circuits, comparator circuits with memory elements, and / or others.

[0244] The low pass filter can comprise a circuit designed to allow signals with frequencies below a certain cutoff frequency to pass through while attenuating higher frequencies. In some implementations, the low-pass filter used in the magnetic interference detection element 136 comprises an analog low-pass filter including one or more resistors, capacitors, inductors, and / or other components. When magnetic interference is present in the sensor data signal, the low-pass filter may filter out the high-amplitude noise associated with the magnetic interference. The output of the low pass filter, labeled as signal "B" in FIG. 47 (e.g., a DC voltage signal), may thus provide a base signal against which to compare the output of the peak detector (i.e., signal A) to determine whether magnetic interference affects or dominates the sensor data signal.

[0245] In some implementations, the cutoff frequency associated with the low pass filter is within a range of about 15 kHz to about 2 MHz, or below about 134 kHz (e.g., to facilitate filtering out of magnetic interference associated with the 134.2 kHz frequency). In some implementations, the cutoff frequency for the low pass filter is about 15 kHz. Although the example shown in FIG. 47 implements a "low pass filter", other types of filters may be used in accordance with the disclosed principles, such as band-pass filters, band-stop filters, and / or others.

[0246] FIG. 47 conceptually depicts one or more logic components, represented by element 4714, which can be included in the magnetic interference detection element 136. The logic component(s) can comprise any hardware or software entity, module, or object configured to process input data or information and produce an output or perform an action based on defined logic or computational rules. As depicted in FIG. 47, the logic component(s) can be configured to compare signal A (output by the peak detector) to signal B (output by the low pass filter) to determine whether magnetic interference affects (or has affected) the sensor data signal. For instance, the logic component(s) may determine whether the difference (e.g., in amplitude) between signal A and signal B satisfies one or more conditions. In some implementations, the condition(s) can be that the amplitude of signal A exceeds the amplitude of signal B by one or more predetermined thresholds. The threshold(s) may be varied for different implementations. This logical test is represented in FIG. 47 by the language "A > B & Above Threshold" associated with element 4714. In one example, the threshold is within a range of 50 mV to 400 mV, or within a range of 100 mV to 300 mV, or within a range of 150 mV to 250 mV, or about 200 mV.

[0247] In some implementations, after the logic component(s) determine that the condition(s) noted above are satisfied (e.g., after determining that the amplitude of signal A exceeds signal B by an applicable threshold), the logic components are configured to set a disqualification (DQ) flag, represented in FIG. 47 by element 4718 and the arrow labeled "Yes" extending from element 4714. When the DQ flag is set, the sensor 110 (and / or other components thereof) may disqualify the data stored in the sensor data buffer (indicated in FIG. 47 by element 4718). For instance, when the D flag is set, the sensor 110 may refrain from further processing the output signal(s) and / or other data stored in the sensor data buffer, thereby refraining from generating analytemeasurement data. Discarding the data stored in the sensor data buffer can additionally or alternatively include deleting the data from the sensor data buffer, refraining from sending data derived from the sensor data signal to other devices / components (e.g., via the communication module 140), coupling a DQ bit or flag with the data stored in the sensor data buffer (and / or downstream data), and / or other methods.

[0248] In some implementations, various additional actions may be triggered when sensor data in the sensor data buffer is being discarded (or when the DQ flag is set). For instance, FIG. 47 indicates that the sensor 110 and / or one or more receivers (e.g., from the set of receivers 172) can be configured to present an alarm (indicated by element 4720) or a notification (indicated by element 4722) when the DQ flag is set or when sensor data in the sensor data buffer is being disqualified or discarded. In some implementations, the notification and / or the alarm can be presented after sensor data has been disqualified for a predetermined time period. In one illustrative example, the notification (e.g., an audible, visible, and / or tactile notification indicating "signal loss") can be presented at the sensor 110 and / or one or more receivers (or other remote devices) after sensor data has been disqualified for about 5 minutes, whereas the alarm (e.g., an audible, visible, and / or tactile alarm) can be presented at the sensor 110 and / or one or more receivers (or other remoted devices) after sensor data has been disqualified for about 20 minutes or greater.

[0249] In some implementations, after the logic component(s) determine that the condition(s) noted above are not satisfied (e.g., after determining that the amplitude of signal A fails to exceed signal B by an applicable threshold), the logic components are configured to generate analyte measurement data (e.g., output data) using the sensor data (e.g., output signals) in the sensor data buffer, represented in FIG. 47 by element 4724 and the arrow labeled "No" extending from element 4714.

[0250] Similar to the magnetic interference detection element 136, the multi-band antenna 138 can be used to determine whether the sensor 110, or a component thereof, is in proximity to magnetic fields that can cause magnetic interference. FIG. 48 is a diagram 4800 illustrating an example multi-band antenna 4802, which corresponds to multi-band antenna 138. The multi-band antenna 4802 of diagram 4800 is in communication with ASIC 4804, which corresponds to ASIC 130. The multi-band antenna 4802 can be configured to detect multiple frequency signals, such as NFC signals (e.g.,13.56 MHz) and magnetic interference signals (e.g., magnetic field signals capable of causing magnetic interference, such as magnetic interference signals within a range of about 30kHz to about 300 kHz, or within a range of about 130 kHz to about 140 kHz). The multi-band antenna 4802 may be configured with various components to facilitate detection of multiple frequency bands, such as one or more NFC antenna PCB loops 4820, one or more NFC antenna tuning capacitors 4822, one or more magnetic proximity (MP) PCB loops 4824, one or more magnetic proximity (MP) tuning capacitors 4826, one or more NFC antenna tuning inductors 4828, and / or other components. An example configuration of such components for a multi-band antenna 4802 is illustrated in FIG. 48, though other configurations are within the scope of the present disclosure. A multi-band antenna 4802 may include additional, fewer, or alternative components relative to those shown in FIG. 48.

[0251] The ASIC 4804 of FIG. 48 includes a detection circuit 4806 connected to the multiband antenna 4802 (via Antenna terminal 1 and Antenna terminal 2, as shown in FIG. 48). The detection circuit 4806 can be configured to receive and process the signal(s) detected by the multi-band antenna 4802 and trigger various actions based on the signal(s). In some instances, the detection circuit 4806 may include various components similar to those described hereinabove with reference to the magnetic interference detection element 136, such as a narrow band filter, rectifier, comparator, digital logic, etc. In some instances, the multi-band antenna 4802 includes one or more matching networks to improve the impedance match between the multi-band antenna 4802 and the detection circuit 4806 at the different detection or target frequencies associated with the multiband antenna 4802 (e.g., 13.56 MHz, 15 kHz to 300 kHz). A high impedance match can contribute to efficient power transfer and / or reduced signal loss at the target frequency bands, which can enable the detection circuit 4806 to properly receive and process signals at either of the target frequency bands. In some instances, the matching network(s) can advantageously enable the same detection circuit 4806 to be used to process and trigger action based on either target frequency band, which can reduce hardware requirements for medical sensor systems 100.

[0252] The detection circuit 4806 may cause different actions based upon whether the target frequency signals associated with the multi-band antenna 4802 (indicative of magnetic interference) are detected. For instance, when one (or both) of the targetfrequencies is detected, the detection circuit 4806 may trigger or set a disqualification flag 4808 ("DQ flag 4808"). The DQflag 4808 may cause disqualification of measurement signal(s) associated with sensor hardware communicatively coupled to the ASIC 4804. The disqualification flag may additionally or alternatively cause disqualification of output signals generated at the ASIC 4804 based on measurement signals of sensor hardware, or may cause disqualification of output data generated by the communication module 140 (or another device).

[0253] Disqualification of measurement signals, output signals, or output data based on a disqualification flag can take on various forms. For instance, the DQ flag 4808 triggered or set by the detection circuit 4806 may comprise a disqualification bit that is set in association with the measurement signals, the output signals, or the output data. The presence of the disqualification bit may trigger various actions by the sensor 110 and / or other devices such as receivers of the set of receivers 172. For instance, the presence of the disqualification bit may cause the sensor 110 and / or other devices to refrain from utilizing the associated measurement signals (or derivatives thereof such as output signals or output data as described herein) in determining analyte levels, trends, or other information about the user wearing the sensor 110. The presence of the disqualification bit can cause components (e.g., the ASIC 130, the communication module 140, receivers, etc.) to refrain from processing or sending measurement signals, output signals, or output data, or may cause components to refrain from utilizing received measurement signals, output signals, or output data (e.g., to determine output information for presentation to or association with users). In some instances, the presence of the disqualification bit may trigger magnetic interference compensation operations to compensate for the magnetic interference in the measurement signals, the output signals, or the output data. In some instances, the presence of the disqualification bit may trigger clearing of signals or data or may trigger processor interrupts, which may cause the system 100 to refrain from acquiring signals and / or data. In some instances, the DQ flag 4808 indicates (e.g., via one or more DQ bits) whether the disqualification is in response to detection of NFC signals (e.g., 13.56 MHz) or other magnetic interference signals (e.g., 15 kHz to 300 kHz, or 130 kHz to 140 kHz).

[0254] The magnetic interference detection element 136 may continuously monitor the measurement signals of the work, reference, or counter nodes to determine whethermagnetic interference remains present or whether magnetic interference is no longer present. If magnetic interference is determined to be no longer present in the measurement signals, the magnetic interference detection element 136 may refrain from triggering or setting the disqualification flag, which may enable the components of the system 100 to continue to gather and process measurement data to provide medical monitoring functionality.

[0255] Although the example discussed with reference to FIG. 48 provides a multi-band antenna 4802, the principles described herein related to data / signal disqualification in response to detecting magnetic interference can be implemented with multiple antennae (e.g., one antenna for NFC signals, and one or more other antennae for other magnetic interference signals). In some implementations, the multi-band antenna 4802 comprises a tri-band antenna configured to detect magnetic interference frequencies, NFC frequencies, and Bluetooth frequencies. In such implementations, the ASIC 4804 may comprise a separate Bluetooth or receive / transmit transceiver circuit that connects to the tri-band antenna (e.g., via an additional antenna terminal).

[0256] For the purpose of illustration and not limitation, reference is made to the example embodiment of a flowchart 1600 for measurement error handling for use with the disclosed subject matter as shown in FIGS. 16A-B. At 1605, the sensor 110 determines whether a temperature measurement result is below a predetermined threshold Tth(e.g., 19 degrees Celsius). As embodied herein, the sensor 110 is configured to operate in a certain temperature range. For example, to preserve the battery of the sensor 110 or the medical hardware 155 of the sensor 110, the sensor 110 can selectively disable certain components. If the temperature measurement result is below the threshold amount, the sensor 110 proceeds to 1615, where the sensor disables communication using the communication module 140. If the temperature measurement result is at or above the threshold amount, the sensor 110 advances to 1610, where communication is enabled. From 1610 or 1615, the sensor 110 advances to 1620, where the sensor 110 determines if the ASIC 130 or the communication module 140 are currently busy (e.g., whether there are pending tasks that have priority over processing the current measurements). If so, the sensor 110 transitions to the error termination state 650 and the process subsequently ends.

[0257] Otherwise, from 1620 the sensor 110 advances to 1625, where the sensor 110 disqualifies the latest recorded measurements. The sensor 110 begins due to a data quality error being detected, and as such, the measurements can be prevented from being used at least in part due to a hardware fault, for the reasons described herein. From 1625, the sensor 110 advances to 1630, where the sensor 110 determines if the ASIC 130 has encountered a brownout (e.g., detects whether an ASIC 130 brownout flag has been set in an appropriate register of the ASIC memory 131) or if registers of the ASIC memory 131 do not match a predetermined value set during the one-time programming of the ASIC 130 or communication module 140. If neither of these conditions are true, the sensor 110 advances to 1650 described herein with respect to FIG. 16B. If either of the conditions are true, the system advances to 1635.

[0258] At 1635, the sensor 110 increments a counter corresponding to the fault determined in 1630. For example, if the ASIC 130 has encountered a brownout, the sensor 110 increments a brownout counter. If the ASIC 130 has a register mismatch, the sensor 110 increments a mismatch counter. At 1635, the sensor 110 compares the current state of the counters to threshold values. If any of the data quality fault counters (e.g., the brownout counter or mismatch counter) meet or exceed a threshold value, the sensor will proceed to the error termination state 650 and measurement error handling (represented in flowchart 1600) terminates. As an example only, the brownout counter threshold value can be set to a relatively high value (e.g., 100, 128, 150, 200, 255) at least in part because the sensor 110 is relatively robust to ASIC brownouts and a procedure for recovery is defined. In contrast, the mismatch counter threshold value can be relatively low (e.g., 1, 3, 5, 10), at least in part because mismatches will be rare and likely indicate a more serious error has occurred or that attempted tampering has been detected. If none of the thresholds have been met, the sensor 110 advances to 1640, where the sensor 110 causes the ASIC 130 to be re-initialized (e.g., cause the ASIC 130 to enter the activation sequence state 730) which will reset data in the ASIC 130. The sensor 110 also, in 1645, disqualifies the next measurement to ensure that no carryover error is included in the patient's measurements. Measurement error handling (represented in flowchart 1600) then terminates.

[0259] Referring now to FIG. 16B, the sensor 110 determines that there has been no ASIC 130 brownout or register mismatch at 1630, and at 1650, the sensor 110 resets thecounters for the brownout or register mismatch errors. The sensor 110 can be programmed to track repetitive errors, as they are indicators of significant faults with the sensor 110. If the sensor 110 has entered the measurement error handling method 1600 and the fault is not due to a brownout event or register mismatch, the sensor 110 can instead continue on to diagnose the issue and response accordingly. At 1655 the sensor 110 determines whether the voltage from the ASIC 130 power supply or inverting charge pump supply is below a threshold value. These can be detected as a power supply monitor 137 of the ASIC 130 regulate the power supply. If the power supply or inverting charge pump supply drops below the set threshold, the power supply monitor 137 can set a flag to be read by the sensor 110. If one of these errors is detected, at 1665, sensor 110 increments a counter designated for power supply errors. If neither of these errors are detected, the sensor 110 instead proceeds to 1660 where the counter is reset. At 1675, sensor 110 processes the results data that have been derived prior to the measurement error being detected.

[0260] From 1665, the sensor advances to 1670, where the sensor 110 compares the current state of the power supply counter to threshold values. If the power supply counter meets or exceeds a threshold value, the sensor 110 will proceed to the error termination state 650 and the method will terminate. As an example only, the power supply counter threshold value can be set to a value attempting to estimate the occurrences of these types of power supply errors during normal operation such that if the power supply counter threshold is above a threshold value an error has likely occurred. If the threshold has not been met, the sensor 110 advances to 1675 where it processes the results data that have been derived prior to the measurement error being detected.

[0261] From 1675, the sensor 110 advances to 1680, where it determines whether a low voltage flag set by the power supply monitor 137 of the ASIC 130 is still set. As embodied herein, the low voltage flag can encompass a register value set by the power supply monitor 137 in response to determining that the voltage has failed to satisfy a preset threshold for a predetermined duration of time. As such, the flag may not necessarily be set in all situations. If the flag is set, the sensor 110 advances to 1685 where it resets or clears that low voltage flag before the method terminates. If the low voltage flag is not set, then the method simply terminates.

[0262] Additionally, or alternatively, as embodied herein, an interrupt request can be encountered during sensor 110 initialization. Generally, the conditions that trigger the interrupt request can be ignored, and the corresponding IRQ status flag can be cleared. For example, if a low voltage or voltage high again flag get triggered before the battery switch is closed (e.g., before sensor 110 initialization is complete), the flag reflects the state of the ASIC power supply that is harvesting energy from the nearby NFC field, not from the battery. Such interrupts can be ignored during initialization by clearing their registers. If an NFC command is detected in this situation, the corresponding register can be cleared, for example to allow the application or receiver 120 to resend the NFC command. Where the communication module 140 detects a brownout event during initialization, the corresponding register can be cleared at least because the ASIC 130 can trigger the same interrupt again. If a brownout is detected again, the communication module is fully awake and thus can handle it through the normal brownout sequence.

[0263] For purpose of illustration and not limitation, reference is made to the example embodiment of a procedure for the sensor 110 in the error termination state 650 for use with the disclosed subject matter as shown in FIG. 17. The sensor 110 can enter the Error Termination state 650 when an unrecoverable error occurs. When the error is detected in insertion failed state 540, active paired state 555, or active expired state 565 the sensor 110 can remain in the Error Termination state 650 for a fixed period of time with the communication module 140 interface enabled prior to shutting down so that remaining data from the sensor 110 can be sent to a receiver 120. If a communication session or communication connection with an authenticated receiver 120 had not been previously established, the sensor 110 can advertise on a repeating basis until a connection is successful. For example, the sensor 110 can advertise every minute until the connection is made without significantly impacting battery capacity. In the error termination state 650, the sensor 110 can wait for a short period of time (e.g., 10 minutes) before disabling the system by disabling activity on general purpose input-output pins, for example to allow communication with the communication module 140 for debugging purposes before the sensor 110 terminates itself. In contrast, the normal termination state 580 can be configured without such a wait time.

[0264] As described herein, the sensor 110 enters the error termination state 650 upon encountering an unrecoverable error. At 1701, the communication module 140 recordsthe error and related events in an appropriate log. The communication module 140 also activates a timer to record the amount of time while the sensor 110 is attempting to offload all data. The communication module increments the timer while repeatedly evaluating if a connection using the communication module 140 has been established with an authenticated receiver 120. At 1702, if no connection is established the communication module attempts to establish the connection on a repeating basis (e.g., by advertising every minute). At 1703, if a connection has been established, the communication module 140 and ASIC hardware abstract layer attempt to upload measurement data from the sensor 110 to the receiver 120. The communication module 140 can repeat 1702 and 1703 until the timer expires or all pending data has been uploaded. Once the timer expires or all pending data has been uploaded, at 1704, the communication module 140 sends a "go to storage mode" command to the ASIC 130 through the ASIC hardware abstraction layer 200 which reformats and forwards the command at 1705 to the ASIC 130 by writing the command to appropriate registers. The ASIC 130 then enters storage state 515. At 1706, the communication module 140 enters a final error termination state. At 1707, the communication module 1707 waits for a predetermined period of time. At 1708, the communication module 140 terminates the sensor 110 by closing the general-purpose input-output pins of the sensor 110.

[0265] For the purpose of illustration and not limitation, reference is made to the example embodiment of a procedure for the sensor 110 in the normal termination state 580 for use with the disclosed subject matter as shown in FIG. 18. The sensor 110 enters the normal termination state 580 when the sensor 110 has reached its expected end of operation, for example when the time of operation has reached its threshold or when an affirmative shutdown command is received. At 1801, the communication module 140 logs any preceding events in an appropriate log. The communication module 140 also activates a timer to record the amount of time while the sensor 110 is attempting to offload all data. The communication module 1140 increments the timer while repeatedly evaluating if a connection using the communication module 140 has been established with an authenticated receiver 120. If a communication session or communication connection with an authenticated receiver 120 had not been previously established, the sensor 110 will advertise on a repeating basis until it is successful. At 1802, if no connection is established the communication module 140 attempts to establish theconnection on a repeating basis (e.g., by advertising every minute). At 1803, if a connection has been established, the communication module 140 and ASIC hardware abstraction layer 200 attempts to upload lingering measurement data from the sensor 110 to the receiver 120. The communication module 140 can repeat 1802 and 1803 until the timer expires or all pending data has been uploaded. Once the timer expires or all pending data has been uploaded, at 1804, the communication module 140 sends a "go to storage mode" command to the ASIC 130 through the ASIC hardware abstraction layer 200 which reformats and forwards the command at 1805 to the ASIC 130 by writing the command to appropriate registers. The ASIC 130 then enters storage mode 710. At 1806, the communication module 140 enters a final normal termination state. At 1807, the communication module 140 terminates the sensor 110 by closing the general-purpose input-output pins of the sensor 110.

[0266] In certain embodiments, the temperature detected by the ASIC 130 or by a temperature sensor associated with the communication module 140 can be used to regulate the transmitter power of the communication module. In addition to affecting the ability of signals from the communication module 140 being detectable by a receiver 120, the receiver 120 can interpret transmitter power to determine a distance between the sensor 110 and the receiver 120. For example, the receiver 120 can compare a perceived transmission power of a received signal to a specified or expected transmitter power to determine a level of drop- off or difference and infer the distance between the sensor 110 and receiver. The receiver can provide this information to a user to assist the user in locating the sensor 110 or the patient to whom the sensor 110 is attached. The receiver 120 can further warn the user that the sensor 110 is out of range or nearly out of range.

[0267] The communication module 140 can be configured to disable transmission upon the temperature failing to satisfy a threshold temperature. The communication module 140 can further be configured to increase or decrease the transmitter power upon the temperature crossing certain interim thresholds. For example, the sensor 110 can have defined a threshold (e.g., 23 degrees Celsius) for full power transmission by the communication module (e.g., +4.6 dBm). The sensor 110 can also have defined a threshold (e.g., 19 degrees Celsius) for turning off transmitter functionality. Between the two thresholds, an interim transmitter power can be used (e.g., +0.4 dBm). Furthermore,the communication module 140 can integrate benchmark values to offset potential hysteresis effects where the change in the transmitter power causes the change in temperature, thus mitigating potential race conditions. For example, a hysteresis value of 0.2 degrees Celsius can be used as a benchmark.

[0268] FIG. 19 illustrates a graph 1900 depicting potential relationship between the transmitter power set for the communication module 140 and the recorded temperature. The graph in FIG. 19 includes two axes: a horizontal axis corresponding to temperature and a vertical axis corresponding to the transmitter power setting. The horizontal axis includes four marked positions. These four positions include two temperature thresholds Taand Tband the two temperature threshold augmented by the hysteresis value H, Ta+ H and Tb+ H. The vertical axis includes three marked positions. These three positions include three power levels: Tx0, Txl, and Tx2. In certain embodiments, Tx0corresponds to turning the transmitter power off, Tx2corresponds to a maximum permitted transmitter power, and Txlcorresponds to an interim transmitter power. The graph includes four lines, 1910, 1920, 1930, and 1940 each illustrating example changes in transmitter power level correlated to the temperature. Line 1910 illustrates that for temperatures between temperature Taand Ta+ H, the transmitter power remains at Tx0. But, when the temperature reaches Ta+ H (e.g., passes the hysteresis value), the transmitter power can shift to Txl. For temperatures between Ta+ H and Tb+ H, as illustrated by line 1930, the transmitter power stays at Txl. When the temperature reaches Tb+ H (e.g., the temperature exceeds the second threshold value and hysteresis value), the transmitter power increases to Tx2. The process is similar in the reverse. As illustrated by line 1940, as the temperature decreases from Tb+ H to Tb, the transmitter power remains at Tx2. Once the temperature reaches Tb, the transmitter power is decreased to Txl. Between temperature Tband Ta, the transmitter power remains at Txl. However, once the temperature reaches Ta, the transmitter power is reduced to Tx0.

[0269] In addition to the specific embodiments claimed hereinafter, the disclosed subject matter is also directed to other embodiments having any other possible combination of the dependent features claimed below and those disclosed above and in the attached figures. As such, the particular features disclosed herein can be combined with each other in other manners within the scope of the disclosed subject matter such that the disclosedsubject matter should be recognized as also specifically directed to other embodiments having any other possible combinations. Thus, the foregoing description of specific embodiments of the disclosed subject matter has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosed subject matter to those embodiments disclosed.

[0270] It will be apparent to those skilled in the art that various modifications and variations can be made in the method and system of the disclosed subject matter without departing from the spirit or scope of the disclosed subject matter. Thus, it is intended that the disclosed subject matter include modifications and variations that are within the scope of the appended claims and their equivalents.

[0271] Embodiments disclosed herein can include those in the following numbered clauses:

[0272] Clause 1. An analyte sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC comprises a magnetic interference detection element configured to indicate when magnetic interference is represented in a measurement signal generated by the sensor hardware; and the analyte sensor is configured to disqualify sensor data associated with the analyte sensor in response to the magnetic interference detection element indicating a presence of magnetic interference in a measurement signal generated by the sensor hardware.

[0273] Clause 2. The analyte sensor of clause 1, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

[0274] Clause 3. The analyte sensor of clause 1, wherein the ASIC and the sensor hardware are communicatively coupled via a work channel, a reference channel, and / or a counter channel.

[0275] Clause 4. The analyte sensor of clause 3, wherein the magnetic interference detection element is implemented at the work channel, the reference channel, and / or the counter channel.

[0276] Clause 5. The analyte sensor of clause 1, wherein the magnetic interference detection element comprises at least a peak detector and a low pass filter.

[0277] Clause 6. The analyte sensor of clause 5, wherein the low pass filter is configured to attenuate frequencies above a cutoff frequency, wherein the cutoff frequency is within a range of about 15 kHz to about 2 MHz.

[0278] Clause 7. The analyte sensor of clause 6, wherein the cutoff frequency is below about 134 kHz.

[0279] Clause 8. The analyte sensor of clause 5, wherein the peak detector is configured to process the measurement signal generated by the sensor hardware to provide a first signal, and wherein the low pass filter is configured to filter the measurement signal generated by the sensor hardware to provide a second signal.

[0280] Clause 9. The analyte sensor of clause 8, wherein the magnetic interference detection element further comprises one or more logic components configured to determine whether a difference between the first signal and the second signal satisfies one or more conditions.

[0281] Clause 10. The analyte sensor of clause 9, wherein the one or more conditions comprise the first signal comprising an amplitude that exceeds the second signal by a predetermined threshold.

[0282] Clause 11. The analyte sensor of clause 9, wherein the one or more logic components are configured to set a disqualification flag after determining that the difference between the first signal and the second signal satisfies the one or more conditions, wherein setting the disqualification flag triggers disqualification of the sensor data associated with the analyte sensor.

[0283] Clause 12. The analyte sensor of clause 1, wherein disqualifying the sensor data associated with the analyte sensor comprises discarding data within a sensor data buffer, wherein the sensor data buffer stores one or more measurement signals, one or more output signals, one or more output data, or data based on the one or more measurement signals, the one or more output signals, or the one or more output data.

[0284] Clause 13. The analyte sensor of clause 1, wherein the analyte sensor is configured to present an alarm or a notification after disqualifying sensor data associated with the analyte sensor for one or more predetermined time periods.

[0285] Clause 14. An analyte sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC is in communication with a multi-band antenna configured to detect (i) nearfield communication (NFC) signals and (ii) magnetic interference signals; and the analyte sensor is configured to disqualify one or more measurement signals, one or more output signals, or one or more output data in response to the multi-band antenna detecting a presence of (i) NFC signals or (ii) magnetic interference signals.

[0286] Clause 15. The analyte sensor of clause 14, wherein the magnetic interference signals are associated with a frequency within a range of about 130 kHz to about 140 kHz.

[0287] Clause 16. The analyte sensor of clause 14, wherein the multi-band antenna is configured to detect magnetic interference signals associated with a frequency within a range of about 15 kHz to about 300 kHz.

[0288] Clause 17. The analyte sensor of clause 14, wherein the multi-band antenna comprises one or more matching networks that facilitate impedance matching for (i) the NFC signals and (ii) the magnetic interference signals.

[0289] Clause 18. The analyte sensor of clause 14, wherein disqualifying the one or more measurement signals, the one or more output signals, or the one or more output data comprises associating a disqualification flag with the one or more measurement signals, the one or more output signals, or the one or more output data.

[0290] Clause 19. The analyte sensor of clause 18, wherein the disqualification flag indicates whether disqualification is in response to the multi-band antenna detecting (i) NFC signals or (ii) magnetic interference signals.

[0291] Clause 20. An analyte sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices;and the ASIC comprises a magnetic interference filter that intervenes between the sensor hardware and the ASIC, wherein the magnetic interference filter is configured to filter magnetic interference in a measurement signal generated by the sensor hardware.

[0292] Clause 21. The analyte sensor of clause 20, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

[0293] Clause 22. The analyte sensor of clause 20, wherein the magnetic interference filter comprises a resistive element and a capacitive element.

[0294] Clause 23. The analyte sensor of clause 22, wherein the resistive element comprises a resistance within a range of about IK Ohms to about 100K Ohms, or within a range of about 28K Ohms to about 38K Ohms.

[0295] Clause 24. The analyte sensor of clause 22, wherein the capacitive element comprises a capacitance within a range of about 1 pF to about 1 nF, or within a range of about 24 pF to about 30 pF.

[0296] Clause 25. A glucose sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC comprises a magnetic interference detection element configured to indicate when magnetic interference is represented in a measurement signal generated by the sensor hardware; and the glucose sensor is configured to disqualify sensor data associated with the glucose sensor in response to the magnetic interference detection element indicating a presence of magnetic interference in a measurement signal generated by the sensor hardware.

[0297] Clause 26. The glucose sensor of clause 25, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

[0298] Clause 27. The glucose sensor of clause 25, wherein the ASIC and the sensor hardware are communicatively coupled via a work channel, a reference channel, and / or a counter channel.

[0299] Clause 28. The glucose sensor of clause 27, wherein the magnetic interference detection element is implemented at the work channel, the reference channel, and / or the counter channel.

[0300] Clause 29. The glucose sensor of clause 25, wherein the magnetic interference detection element comprises at least a peak detector and a low pass filter.

[0301] Clause 30. The glucose sensor of clause 29, wherein the low pass filter is configured to attenuate frequencies above a cutoff frequency, wherein the cutoff frequency is within a range of about 15 kHz to about 2 MHz.

[0302] Clause 31. The glucose sensor of clause 30, wherein the cutoff frequency is below about 134 kHz.

[0303] Clause 32. The glucose sensor of clause 29, wherein the peak detector is configured to process the measurement signal generated by the sensor hardware to provide a first signal, and wherein the low pass filter is configured to filter the measurement signal generated by the sensor hardware to provide a second signal.

[0304] Clause 33. The glucose sensor of clause 32, wherein the magnetic interference detection element further comprises one or more logic components configured to determine whether a difference between the first signal and the second signal satisfies one or more conditions.

[0305] Clause 34. The glucose sensor of clause 33, wherein the one or more conditions comprise the first signal comprising an amplitude that exceeds the second signal by a predetermined threshold.

[0306] Clause 35. The glucose sensor of clause 33, wherein the one or more logic components are configured to set a disqualification flag after determining that the difference between the first signal and the second signal satisfies the one or more conditions, wherein setting the disqualification flag triggers disqualification of the sensor data associated with the glucose sensor.

[0307] Clause 36. The glucose sensor of clause 25, wherein disqualifying the sensor data associated with the glucose sensor comprises discarding data within a sensor data buffer, wherein the sensor data buffer stores one or more measurement signals, one or more output signals, one or more output data, or data based on the one or more measurement signals, the one or more output signals, or the one or more output data.

[0308] Clause 37. The glucose sensor of clause 25, wherein the glucose sensor is configured to present an alarm or a notification after disqualifying sensor data associated with the glucose sensor for one or more predetermined time periods.

[0309] Clause 38. A glucose sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC is in communication with a multi-band antenna configured to detect (i) nearfield communication (NFC) signals and (ii) magnetic interference signals; and the glucose sensor is configured to disqualify one or more measurement signals, one or more output signals, or one or more output data in response to the multi-band antenna detecting a presence of (i) NFC signals or (ii) magnetic interference signals.

[0310] Clause 39. The glucose sensor of clause 38, wherein the magnetic interference signals are associated with a frequency within a range of about 130 kHz to about 140 kHz.

[0311] Clause 40. The glucose sensor of clause 38, wherein the multi-band antenna is configured to detect magnetic interference signals associated with a frequency within a range of about 15 kHz to about 300 kHz.

[0312] Clause 41. The glucose sensor of clause 38, wherein the multi-band antenna comprises one or more matching networks that facilitate impedance matching for (i) the NFC signals and (ii) the magnetic interference signals.

[0313] Clause 42. The glucose sensor of clause 38, wherein disqualifying the one or more measurement signals, the one or more output signals, or the one or more output data comprises associating a disqualification flag with the one or more measurement signals, the one or more output signals, or the one or more output data.

[0314] Clause 43. The glucose sensor of clause 42, wherein the disqualification flag indicates whether disqualification is in response to the multi-band antenna detecting (i) NFC signals or (ii) magnetic interference signals.

[0315] Clause 44. A glucose sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; theASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; and the ASIC comprises a magnetic interference filter that intervenes between the sensor hardware and the ASIC, wherein the magnetic interference filter is configured to filter magnetic interference in a measurement signal generated by the sensor hardware.

[0316] Clause 45. The glucose sensor of clause 44, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

[0317] Clause 46. The glucose sensor of clause 44, wherein the magnetic interference filter comprises a resistive element and a capacitive element.

[0318] Clause 47. The glucose sensor of clause 46, wherein the resistive element comprises a resistance within a range of about IK Ohms to about 100K Ohms, or within a range of about 28K Ohms to about 38K Ohms.

[0319] Clause 48. The glucose sensor of clause 46, wherein the capacitive element comprises a capacitance within a range of about 1 pF to about 1 nF, or within a range of about 24 pF to about 30 pF.

[0320] Also envisaged and encompassed in the disclosure herein are apparatus comprising means for implementing any of the methods described herein, including any of the preferred features.

Claims

CLAIMSWe Claim:

1. An analyte sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC comprises a magnetic interference detection element configured to indicate when magnetic interference is represented in a measurement signal generated by the sensor hardware; and the analyte sensor is configured to disqualify sensor data associated with the analyte sensor in response to the magnetic interference detection element indicating a presence of magnetic interference in a measurement signal generated by the sensor hardware.

2. The analyte sensor of claim 1, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

3. The analyte sensor of claim 1, wherein the ASIC and the sensor hardware are communicatively coupled via a work channel, a reference channel, and / or a counter channel.

4. The analyte sensor of claim 3, wherein the magnetic interference detection element is implemented at the work channel, the reference channel, and / or the counter channel.

5. The analyte sensor of claim 1, wherein the magnetic interference detection element comprises at least a peak detector and a low pass filter.

6. The analyte sensor of claim 5, wherein the low pass filter is configured to attenuate frequencies above a cutoff frequency, wherein the cutoff frequency is within a range of about 15 kHz to about 2 MHz.

7. The analyte sensor of claim 6, wherein the cutoff frequency is below about 134 kHz.

8. The analyte sensor of claim 5, wherein the peak detector is configured to process the measurement signal generated by the sensor hardware to provide a first signal, and wherein the low pass filter is configured to filter the measurement signal generated by the sensor hardware to provide a second signal.

9. The analyte sensor of claim 8, wherein the magnetic interference detection element further comprises one or more logic components configured to determine whether a difference between the first signal and the second signal satisfies one or more conditions.

10. The analyte sensor of claim 9, wherein the one or more conditions comprise the first signal comprising an amplitude that exceeds the second signal by a predetermined threshold.

11. The analyte sensor of claim 9, wherein the one or more logic components are configured to set a disqualification flag after determining that the difference between the first signal and the second signal satisfies the one or more conditions, wherein setting the disqualification flag triggers disqualification of the sensor data associated with the analyte sensor.

12. The analyte sensor of claim 1, wherein disqualifying the sensor data associated with the analyte sensor comprises discarding data within a sensor data buffer, wherein the sensor data buffer stores one or more measurement signals, one or more output signals, one or more output data, or data based on the one or more measurement signals, the one or more output signals, or the one or more output data.

13. The analyte sensor of claim 1, wherein the analyte sensor is configured to present an alarm or a notification after disqualifying sensor data associated with the analyte sensor for one or more predetermined time periods.

14. An analyte sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices;the ASIC is in communication with a multi-band antenna configured to detect (i) near-field communication (NFC) signals and (ii) magnetic interference signals; and the analyte sensor is configured to disqualify one or more measurement signals, one or more output signals, or one or more output data in response to the multi-band antenna detecting a presence of (i) NFC signals or (ii) magnetic interference signals.

15. The analyte sensor of claim 14, wherein the magnetic interference signals are associated with a frequency within a range of about 130 kHz to about 140 kHz.

16. The analyte sensor of claim 14, wherein the multi-band antenna is configured to detect magnetic interference signals associated with a frequency within a range of about 15 kHz to about 300 kHz.

17. The analyte sensor of claim 14, wherein the multi-band antenna comprises one or more matching networks that facilitate impedance matching for (i) the NFC signals and (ii) the magnetic interference signals.

18. The analyte sensor of claim 14, wherein disqualifying the one or more measurement signals, the one or more output signals, or the one or more output data comprises associating a disqualification flag with the one or more measurement signals, the one or more output signals, or the one or more output data.

19. The analyte sensor of claim 18, wherein the disqualification flag indicates whether disqualification is in response to the multi-band antenna detecting (i) NFC signals or (ii) magnetic interference signals.

20. An analyte sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; and the ASIC comprises a magnetic interference filter that intervenes between the sensor hardware and the ASIC, wherein the magnetic interference filter is configured to filter magnetic interference in a measurement signal generated by the sensor hardware.

21. The analyte sensor of claim 20, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

22. The analyte sensor of claim 20, wherein the magnetic interference filter comprises a resistive element and a capacitive element.

23. The analyte sensor of claim 22, wherein the resistive element comprises a resistance within a range of about IK Ohms to about 100K Ohms, or within a range of about 28K Ohms to about 38K Ohms.

24. The analyte sensor of claim 22, wherein the capacitive element comprises a capacitance within a range of about 1 pF to about 1 nF, or within a range of about 24 pF to about 30 pF.

25. A glucose sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC comprises a magnetic interference detection element configured to indicate when magnetic interference is represented in a measurement signal generated by the sensor hardware; and the glucose sensor is configured to disqualify sensor data associated with the glucose sensor in response to the magnetic interference detection element indicating a presence of magnetic interference in a measurement signal generated by the sensor hardware.

26. The glucose sensor of claim 25, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

27. The glucose sensor of claim 25, wherein the ASIC and the sensor hardware are communicatively coupled via a work channel, a reference channel, and / or a counter channel.

28. The glucose sensor of claim 27, wherein the magnetic interference detection element is implemented at the work channel, the reference channel, and / or the counter channel.

29. The glucose sensor of claim 25, wherein the magnetic interference detection element comprises at least a peak detector and a low pass filter.

30. The glucose sensor of claim 29, wherein the low pass filter is configured to attenuate frequencies above a cutoff frequency, wherein the cutoff frequency is within a range of about 15 kHz to about 2 MHz.

31. The glucose sensor of claim 30, wherein the cutoff frequency is below about 134 kHz.

32. The glucose sensor of claim 29, wherein the peak detector is configured to process the measurement signal generated by the sensor hardware to provide a first signal, and wherein the low pass filter is configured to filter the measurement signal generated by the sensor hardware to provide a second signal.

33. The glucose sensor of claim 32, wherein the magnetic interference detection element further comprises one or more logic components configured to determine whether a difference between the first signal and the second signal satisfies one or more conditions.

34. The glucose sensor of claim 33, wherein the one or more conditions comprise the first signal comprising an amplitude that exceeds the second signal by a predetermined threshold.

35. The glucose sensor of claim 33, wherein the one or more logic components are configured to set a disqualification flag after determining that the difference between the first signal and the second signal satisfies the one or more conditions, wherein setting the disqualification flag triggers disqualification of the sensor data associated with the glucose sensor.

36. The glucose sensor of claim 25, wherein disqualifying the sensor data associated with the glucose sensor comprises discarding data within a sensor data buffer, wherein the sensor data buffer stores one or more measurement signals, one or more output signals, one or more output data, or data based on the one or more measurement signals, the one or more output signals, or the one or more output data.

37. The glucose sensor of claim 25, wherein the glucose sensor is configured to present an alarm or a notification after disqualifying sensor data associated with the glucose sensor for one or more predetermined time periods.

38. A glucose sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; the ASIC is in communication with a multi-band antenna configured to detect (i) near-field communication (NFC) signals and (ii) magnetic interference signals; and the glucose sensor is configured to disqualify one or more measurement signals, one or more output signals, or one or more output data in response to the multi-band antenna detecting a presence of (i) NFC signals or (ii) magnetic interference signals.

39. The glucose sensor of claim 38, wherein the magnetic interference signals are associated with a frequency within a range of about 130 kHz to about 140 kHz.

40. The glucose sensor of claim 38, wherein the multi-band antenna is configured to detect magnetic interference signals associated with a frequency within a range of about 15 kHz to about 300 kHz.

41. The glucose sensor of claim 38, wherein the multi-band antenna comprises one or more matching networks that facilitate impedance matching for (i) the NFC signals and (ii) the magnetic interference signals.

42. The glucose sensor of claim 38, wherein disqualifying the one or more measurement signals, the one or more output signals, or the one or more output data comprises associating a disqualification flag with the one or more measurement signals, the one or more output signals, or the one or more output data.

43. The glucose sensor of claim 42, wherein the disqualification flag indicates whether disqualification is in response to the multi-band antenna detecting (i) NFC signals or (ii) magnetic interference signals.

44. A glucose sensor comprising an application-specific integrated circuit (ASIC), sensor hardware, and a communication module, wherein: the ASIC is communicatively coupled to the sensor hardware and the communication module; the ASIC is configured to receive measurement signals from the sensor hardware and provide an output signal to the communication module; the communication module is configured to communicate output data based on the output signal to one or more external devices; and the ASIC comprises a magnetic interference filter that intervenes between the sensor hardware and the ASIC, wherein the magnetic interference filter is configured to filter magnetic interference in a measurement signal generated by the sensor hardware.

45. The glucose sensor of claim 44, wherein the magnetic interference is associated with a frequency within a range of about 130 kHz to about 140 kHz.

46. The glucose sensor of claim 44, wherein the magnetic interference filter comprises a resistive element and a capacitive element.

47. The glucose sensor of claim 46, wherein the resistive element comprises a resistance within a range of about IK Ohms to about 100K Ohms, or within a range of about 28K Ohms to about 38K Ohms.

48. The glucose sensor of claim 46, wherein the capacitive element comprises a capacitance within a range of about 1 pF to about 1 nF, or within a range of about 24 pF to about 30 pF.

Images