Techniques for controlling an insulin pump include determining values for parameters selected from a group including a first prediction time horizon, a predicted glucose threshold (Goff) for turning the insulin pump off, a maximum shut off time within a time window, and duration of the time window. A safety rule is determined based on the maximum shut off time within the duration. Glucose readings are collected up to a current time. An expected current glucose value G and glucose temporal rate of change are determined based only on the glucose readings and a Kalman filter configured for noisy glucose readings. A glucose level (Gh1) is predicted for a future time that is the prediction time horizon after the current time. A command is issued to shut off the insulin pump if it is determined both that Gh1 is less than Goff and that the safety rule is satisfied.