Software Architecture · Test Bench

Contents

1. Overall picture
2. Core allocation and the M33
3. Sample rates and signal path
4. Inter-core communication (shared ring · RPMsg)
5. Latency budget
6. Holter storage · trends
7. Alarm engine
8. State machine
9. Power-on self-test
10. Cloud · security · updates
11. Software safety-class separation · modules
12. Development order · measurement list
13. Test-bench firmware (ESP32-S3 + ADS1293)
14. Test-bench verification results

1. Overall picture

The processor is the NXP i.MX 95. The measurement section that touches the patient (patient island) is isolated and connects to the processor through digital isolators (ISO7762). The processor chip set (i.MX 95 · AFE159RP8 · AFE4490 · stage-2 RM44L920) is Confirmed specification; the core allocation below is a Default.

 Patient island (isolated, CF)         │ Non-patient side (i.MX 95 SoM)
 ──────────────────────────────────────┼───────────────────────────────────────
 AFE159RP8 (ECG 8ch, 10 electrodes, pace on-chip) ─ISO7762#1─ LPSPI-A ┐
 AFE4490   (SpO2, PRF 500 Hz)            ─ISO7762#2─ LPSPI-B ├─► Cortex-M7 800 MHz (FreeRTOS)
 V1/V5 switch · sim/signal switch state  ─(isolated GPIO)────┘   acquisition·filters·QRS·pace·SpO2
 (+option) NIBP module UART · Resp (AFE built-in)                   ·alarm decision·alarm tone
                                                    │ shared DDR ring (waveforms) + RPMsg (commands·events)
                                                    ▼
                         Cortex-A55 ×6 (Linux, Yocto)  display (Qt)·Holter·trends·cloud·OTA·logs·permissions
                         Cortex-M33 (NXP SM)           power·clocks·reset·PMIC·fault reaction (per-LM reset)
 External: TPS3430 window watchdog (kicked by M7) → WDO → backup buzzer + A55 GPIO   [stage 2] RM44L920 safety MCU (SPI)
 LTC1760 + smart packs A/B (SMBus, owned by M7) · VSYS undervoltage comparator → M7 IRQ

Three core-allocation principles Default

1. The patient-safety path (acquisition → decision → alarm tone) is closed within the M7 alone. Even if Linux dies, the sound still plays.
2. Linux only does "display, store, send." If Linux stalls, the M7 notices and sounds a high-priority "display failure."
3. If the M7 stalls, the System Manager (SM) resets only the M7; meanwhile the TPS3430 sounds the backup buzzer and the A55 turns the waveforms gray.

2. Core allocation and the M33

Responsibilities by core Default

Resource ownership (fixed by SM configuration)

Resource budget (calculated · default)

3. Sample rates and signal path

Why 8 kSPS

• IEC 60601-2-27 requires pace pulses to be excluded from HR calculation. Range ±2 to ±700 mV, 0.1 to 2 ms (the lower width limit is taken at the wider-coverage 0.1 ms)
• TI ADS1298 datasheet: software detection needs "8 kSPS or more." Published figures: 8 kHz Se 95.5 % · 16 kHz 97.1 % · 32 kHz 99.3 % (CinC 2018)
• The AFE159RP8 has an on-chip 4-lead pace algorithm + 128 kSPS pace output. However, the public version is a summary, so the detection output format, width and amplitude range are Unverified

Default All ECG channels are acquired at 8 kSPS 24-bit. Pace uses on-chip detection (primary) + M7 software detection (secondary confirmation). If the detailed datasheet confirms that on-chip detection fully meets the requirements, lowering to 2 kSPS will be considered; until then, fixed at 8 kSPS.

Path inside the M7

AFE159RP8 8 kSPS × 8ch × 24bit ── DRDY ISR → LPSPI DMA ─┐
                                                         ├─ ① timestamping (general timer 32bit, sample number u64)
AFE4490 500 SPS × 6 streams ── ADC_RDY ISR → LPSPI ──────┘
   ├─ ② pace: chip flag + 8 kSPS slope · width check → event {sample number, lead, width}
   ├─ ③ pace blanking: fill the pulse interval by linear interpolation at 8 kSPS
   ├─ ④ decimation 8000 → 2000 → 500 SPS (2-stage linear-phase FIR, ÷4·÷4)
   │      group delay estimate: 31 taps (8k) 1.9 ms + 63 taps (2k) 15.5 ms ≈ 17.4 ms (calculated)
   ├─ ⑤ "raw data" branch → Holter storage (500 SPS 24bit, pre-notch · pre-HPF) + calib row
   ├─ ⑥ HPF → dual adaptive notch (60·120 Hz) → LPF   (keep both pre- and post-notch — for comparison view)
   ├─ ⑦ QRS detection (separate 5–15 Hz band, independent of notch state)
   │      pace events excluded from HR · marked only when "Paced=Yes"
   └─ ⑧ PPG: 500 SPS → 5-sample average 100 SPS → band-pass filter → R · SpO2 · PR · PI. 1 s period

Reason for going down to 500 SPS: the previously designed dual-notch coefficients are based on fs = 500 Hz and can be reused as-is. Blanking length and FIR tap counts will be set by measurement in the signal-processing design.

Channel assignment Default

Downsampling for display

• Each column (px) is drawn as a min/max vertical line to preserve QRS peaks. Simple decimation is prohibited
• PPG 100 SPS uses linear interpolation between neighboring samples
• Screen row order is 6 rows fixed: calib · lead1 · lead2 · lead3 · SpO2 · pulse Confirmed. The screen position of the V lead (V1/V5) is TBD; it is always included in the recording

4. Inter-core communication — shared memory ring + RPMsg

RPMsg common header (24 B, little-endian) Default

Two endpoints: ekg-ctrl (A55 → M7 commands, M7 responses) · ekg-evt (M7 → A55 events · status).

Main messages Default

Shared memory rings (calculated · default)

All rings have power-of-two lengths; indices are the global sample number u64 masked. The M7 writes all the data, then a memory barrier → write-index update. CRC-32C per block (20 ms = 10 samples).

The reserved region is non-cacheable. Whether this DDR region survives intact when only the A55 is reset is Unverified — measurement item S-01.

5. Latency budget

Electrode → screen (calculated · default)

Alarms Default

6. Holter storage · trends

Principles

• The on-device record is the master copy; the cloud holds a copy
• The stored signal is raw data before notch · HPF (500 SPS 24-bit). Filters are reapplied when viewing → can be re-analyzed
• Basic 5 electrodes, 4 channels: 518.4 MB per day; 12-lead, 8 channels: 1.04 GB per day (calculated) → eMMC pSLC 32 GB or more

1-second blocks Default

Fixed-size slots: 4 channels 8 KiB, 8 channels 16 KiB (eMMC 4 KiB aligned). Segment files of 1 hour = 3600 slots are preallocated so that file metadata does not change during writing.

• Pace raw waveforms are not stored at high speed; only the instants are recorded (a 128 kSPS raw waveform would be about 88 GB per day)
• Writing: one-slot pwrite + fdatasync every second. The writer thread shares no locks with the render thread
• File system: ext4 data=ordered + preallocation + fdatasync per block as default, F2FS as alternative. Final choice after repeated forced power cuts followed by hash-chain checks
• Data lost: only in a sudden outage where both battery packs disconnect simultaneously, ≤ 1–2 s. Zero on the normal shutdown path
• Recovery at startup: check CRC · hash chain of the last segment from the end → a broken tail is marked "not recorded" + "recording gap" annotation. The gap is not filled in
• Export: EDF+/BDF (24-bit) or WFDB-FLAC by default; ISHNE · DICOM Ambulatory (16-bit) for compatibility. Master blocks stay as they are

Trend DB Default

• The master is the 1-second trend record inside the Holter blocks. If the DB is corrupted, it is rebuilt from the blocks
• SQLite for queries (WAL, synchronous=FULL) — 1-second table + 1-min · 5-min · 1-hour aggregate tables
• Retention 1 year (5–6 parameters at 1 s, 2 B → 315–378 MB, calculated). Window 30 min to 7 days
• SpO2-derived indices are labeled "reference value · not calibrated"

7. Alarm engine (IEC 60601-1-8 priorities)

• M7 AlarmCore: condition decision, prioritization, latching, pause timer, alarm tone synthesis. If no settings have arrived, it runs with compiled-in default limits
• A55 AlarmUI: visual signals (color · blinking · text), operation, alarm log, remote supplementary notification. It makes no decisions
• Visual cross-check: the M7 receives the "displayed alarm ID list" in HB_UI; if an active alarm is absent from the screen for more than 2 s, "display failure" (high)
• Stage 2: the RM44L920 decides independently from the same inputs and cross-checks against the M7 result

Priorities · signals Default

• Sound frequency: main energy 500–1000 Hz, speaker + synthesized waveform (considering age-related hearing loss, a 4 kHz piezo alone is not used)
• Pause default 2 min, automatically restored at the end. Technical alarms non-latching; physiological alarms configurable (default latching)
• Not distinguished by color alone: fill + text + icon + flashing + sound

Alarm list (excerpt) Default

Arrhythmia classification results are not used for alarms. They are for records and reference only.

8. State machine

Three axes overlap: device state (S) × per-parameter signal validity × power state (P).

Device states Default

Two principles: never show a frozen normal waveform · the alarm tone survives even if the main processor dies.

Power states Default

9. Power-on self-test (POST) · periodic tests

Periodic tests (during measurement): the calib row doubles as continuous self-diagnosis using the internal test signal; if amplitude is outside ±2 %, "AFE gain abnormal." Supply · temperature are cycled through spare channels every few seconds.

10. Cloud · security · updates

Cloud — store offline, then sync Default

• Data accumulates in an outbox (SQLite queue) and is sent in order, oldest first, when connected
• Real-time channel: MQTT 5 QoS1, TLS 1.3 mutual authentication — status · events · 1-min trends · alarms only (waveforms are not sent because of message size limits)
• Waveforms: resumable upload of 1-hour segment files. The server checks the hash chain, then sends "receipt confirmed"
• Deletion: only items confirmed received, after 14 days. Unconfirmed items are never deleted automatically
• Device authentication: per-device X.509, private key in a secure chip. Server in a domestic region; separate health-information consent screen at first setup
• Caregiver app notifications are supplementary notifications not counted as part of the alarm system. The main unit's sound and screen are primary
• Firewall: zero inbound connections. Local service port only in service mode

Boot chain (AHAB)

Boot ROM ─(ELE verify)─► boot container [SM(M33) · U-Boot SPL · ATF · OP-TEE · U-Boot]
         U-Boot ─(AHAB auth)─► M7 firmware container (in A/B slot) → M7 start → acquisition start
         U-Boot ─(signed FIT)─► kernel + DTB + initramfs (A/B slot) → rootfs dm-verity

Placing the M7 firmware in the A/B slots means it is updated and rolled back together with Linux as one bundle. The cost is that M7 start is delayed until the U-Boot stage (a few seconds, to be measured). The AHAB signing procedure and rollback counter for the i.MX 95 are Unverified.

OTA (RAUC A/B, signature required) Default

• Bundle = rootfs + kernel FIT + M7 firmware + settings migration script = one release number
• Installation conditions: patient not connected (all electrodes lead-off + SpO2 sensor off) + AC connected + Holter session closed + confirmation by an authorized person. During measurement, download only
• Health check: new slot boots → POST passed + M7 HELLO version match + first UI frame → marked good. 3 failures → previous slot
• USB offline updates use the same signed bundle. Nothing is executed before signature verification
• Data protection: /data encryption, DDR inline encryption, communication TLS 1.3

User permissions Default

Safety settings (alarm limits · minimum volume · Paced) become "applied" only after CFG_SET to the M7 → read-back confirmation. The M7 keeps running with the last confirmed values.

11. Software safety-class separation (IEC 62304) · modules

Basis for the separation: separate cores + SM resource isolation (per LM) + the M7 runs without Linux + external window watchdog. Whether this separation is accepted under the standard is up to the test laboratory, so it is Unverified.

Modules (excerpt)

Signal-processing code (dsp/) is kept as hardware-independent C so it also builds on a PC, and is unit-tested by replaying public ECG databases. Changing the RTOS would also cost little.

12. Development order · measurement list Default

Undecided items: lead III handling in the 12-lead option (calculated or 2 AFEs), screen position of the V1/V5 waveform.

13. Test-bench firmware — ESP32-S3 + ADS1293 + heart-rate/oxygen module

This is a test-bench-only configuration, different from the product (AFE159RP8 · AFE4490 · i.MX 95). Its purpose is to check the signal path, frames and receiving screen first using off-the-shelf modules.

Wiring (ESP32-S3 N16R8)

Pins avoided: 4 · 5 · 6 · 7 · 15 (2.0" display) · 19 · 20 (USB) · 43 · 44 (UART0) · 26–32 (flash) · 33–37 (OPI PSRAM) · 0 · 3 · 45 · 46 (boot strapping) · 38 · 48 (RGB LED, depending on board).

ADS1293 — leads I · II · III all measured directly

Default electrode assignment: RA→IN1, LA→IN2, LL→IN3, RL←IN4 (RLD output). Since the module jack wiring is unverified, the IN numbers can be changed with command e.

Main registers

RL detachment is not caught by lead-off, so whether the RLD output is near the rail (RLDRAIL) is reported separately. Error registers are read every 32 samples, or immediately when the ALARMB bit is set.

Sample rates (datasheet table 8, SDM 102.4 kHz, R1 = 4)

533 was made the default because it is closest to the notch design based on 500 SPS (the notch coefficients must be recalculated for 533.33 Hz). Only 853 covers the 150 Hz diagnostic bandwidth; all three cover the 40 Hz monitoring bandwidth. Input range is INA differential ±400 mV.

Built-in test signals

Since VTEST and VREF come from the same reference, this is not gain calibration; it is for self-test and checking gain differences between channels. The 1 mV calibration signal (calib) is the job of the external battery simulator.

Heart-rate/oxygen module (presumed MAX30102, I2C 0x57)

• Used only when PART_ID is 0x15; otherwise treated as "absent" and a synthetic pulse wave is output (whether the chip is a MAX30102 is Unverified)
• SpO2 mode (red + IR), 100 sps, 18-bit, 6 bytes per sample. Register values are based on public library definitions; cross-check against the original datasheet is Unverified
• No SpO2 number is produced. There is no calibration curve. The receiving screen shows only the R ratio as "reference"
• Being a reflective module, it is only for waveform-path testing. The product uses a transmissive clip probe + AFE4490

Serial protocol

533 SPS × 16 B + 100 × 12 B ≈ 9.7 kB/s (14.9 kB/s at 853 SPS). Binary frames + text lines starting with # (info · 1-second status · warnings); a CSV mode is also available.

ECG frame 16 B : A5 5A 'E' seq(u16 LE) CH1 CH2 CH3(u24, MSB first) flags crc8
PPG frame 12 B : A5 5A 'P' seq(u16 LE) RED IR(u24)                 crc8
crc8 = polynomial 0x07, init 0, from 'E'/'P' through flags

flags: 1 RA detached · 2 LA detached · 4 LL detached · 8 RLD rail · 16 common mode out of range
       32 input out of range · 64 synthetic · 128 test signal

Excerpt of the CRC calculation (the firmware and PC test code use the same header):

static inline uint8_t ekg_crc8(const uint8_t *p, size_t n) {   // polynomial 0x07, initial value 0
  uint8_t c = 0;
  for (size_t i = 0; i < n; i++) {
    c ^= p[i];
    for (int b = 0; b < 8; b++) c = (c & 0x80) ? (uint8_t)((c << 1) ^ 0x07) : (uint8_t)(c << 1);
  }
  return c;
}

Code → voltage conversion uses datasheet equation 13: V = (ADC_OUT/ADCMAX − ½)·2·VREF/3.5.

The synthetic signal is output in the same ADC code form as the ADS1293, so the receiver does not need to distinguish measured from synthetic (only flags 64 differs). The synthetic model sets limb potentials φRA=0, φLA=I, φLL=II and recalculates the leads as potential differences, so III = II − I holds by definition. The 50° electrical axis is an arbitrary value for synthesis.

Receive · display script (shared by PC · Raspberry Pi)

• Saves all received bytes losslessly (raw) + ECG · PPG CSV + log
• Screen: white background, I · II · III · residual II−(I+III) · pulse wave red · pulse wave IR. Title shows heart rate (simple threshold method) · R ratio · fs · gaps · alarms
• Has a replay/inspection mode that re-decodes and checks saved files

Safety — before touching the human body

Test sequence

Always go through ② · ③ before ④. If a DRDYB warning appears in ② (suspected missing crystal), stop there.

14. Test-bench verification results (2026-10-11)

Remaining unverified items (to check after parts arrive)

1. ADS1293 module power configuration (VDD · VDDIO), presence of 4.096 MHz crystal, jack pin assignment, input protection · RLD component values
2. Whether connecting one input pin simultaneously to CH1 + and CH3 − is allowed (judged by the residual)
3. Whether the sensor module is a MAX30102, and whether red · IR are swapped
4. Cross-check against the original MAX30102 datasheet
5. RGB LED pin and USB port type of the ESP32-S3 board
6. How many seconds the 8 nA lead-off takes to respond given cable capacitance
7. Numeric limit for electrode DC current in medical standards