Specification · Requirements

1. Status labels

The specification document lists only confirmed items. Items not yet decided are marked "Undecided", and values or facts not yet verified are marked "Unverified". No field has been filled in by guesswork.

Confirmed Original text of the confirmed specification
Derived from confirmed Requirement recorded as following from the confirmed specification
Design default Value carried over from the design document or proposals; not confirmed
Separate instruction Instructed outside the confirmed specification document (alarm color, screen background rules)
Design decision Value chosen as one of the design defaults; not confirmed
Undecided Not decided
Unverified Value or fact not yet verified

2. Development direction and intended use

3. Inputs · electrodes

4. Display · numeric readouts

Waveforms — continuous scroll Confirmed

In exactly the specified order: 1 calib (calibration) → 2 lead1 → 3 lead2 → 4 lead3 → 5 SpO2 → 6 pulse

The chest lead (V1/V5) row is placed as row 5 right after lead III, giving 7 rows on screen (1 calib · 2 lead I · 3 lead II · 4 lead III · 5 V · 6 SpO2 · 7 pulse). The relative order of the 6 confirmed waveforms is unchanged; the change in the SpO2 · pulse row numbers is not confirmed. Design decision

Readouts beside the waveforms Confirmed

• Pulse rate number
• Heart icon blinking in time with the pulse
• Oxygen saturation xx % — the number is always "Reference value · not calibrated"
• A title and readout in text for each waveform

Screen size and display principles

5. Mains noise removal — dual adaptive notch

Confirmed "60Hz noise is a major problem" — a dual adaptive notch filter is to be designed and then applied.

Design defaults

• Configuration: 2 stages, 60 Hz + 120 Hz, frequency-tracking IIR. 180 Hz stage OFF by default
• Attenuation: 60 Hz stage, diagnostic mode ≥ 40 dB (BW 1 Hz) · monitor mode ≥ 46 dB (BW 2 Hz)
• Convergence: LOCK within ≤ 2.6 s in diagnostic mode after power-on / lead-on
• QRS ringing peak ≤ 25 µV (internal target, not a standard value)
• Notch state (INIT·ACQ·LOCK·HOLD·FAULT) and estimated frequency shown on screen
• Filter modes: monitor 0.5–40 Hz (default) / diagnostic 0.05–150 Hz

6. External EKG simulator

7. Specification upgrade decisions (2026-10-11)

Items confirmed after reviewing the specification upgrade proposal.

8. Main blocks and chips

i.MX 95 overview (based on the official NXP page)

• 6 × Cortex-A55, up to 2.0 GHz — display · cloud · Holter analysis
• Real-time cores: 1 × Cortex-M7 + 1 × Cortex-M33
• Functional safety listed as IEC 61508 SIL 2 (industrial), ISO 26262 ASIL B (automotive). No medical certification (60601·62304) is listed
• NPU eIQ Neutron 2.0 TOPS, GPU OpenGL ES 3.2 · Vulkan 1.2 + 2D
• LPDDR5/LPDDR4X, automatic memory error correction (ECC) and encryption
• Display outputs MIPI-DSI (4 lanes) · dual LVDS. Official wording is 1080p60 — 10.1" 1920×1200 needs to be measured
• Supply until May 2041

Patient protection design

• Applied parts = all ECG electrodes + SpO2 probe. Grouped as one applied-part group and designed to Type CF limits Design default
• Defibrillation-proof CF included in the design. Recovery target ≤ 5 s; the 5 kV test is done by a test laboratory Design decision
• No ESU protection; marking that use near ESU · MRI · CT is prohibited Design decision
• 4 fail-safe states: S0 normal · S1 signal invalid · S2 device failure · S3 safe stop Design default
• Software safety class: since alarms are included, IEC 62304 Class C (alarm decision · fail-safe = C, display = B can be separated) Design default

9. Power · battery · cooling · noise

Confirmed

• 24 hours of continuous operation on battery alone (purpose: power outage backup, memory recording, smooth operation)
• 2 batteries; the device does not stop even during replacement (hot swap). AC power must always be connected
• Cell count · capacity · pack configuration are "Undecided" — determined from the 24-hour power budget
• Fanless by default
• There must be no audible noise — based on an elderly patient lying in a quiet room. If a fan becomes necessary, use a silent fan or reduce noise by lowering the rotation speed

Power budget and runtime (design review results)

Fanless thermal and silent design

• Heat path: SoC → thermal pad → aluminum back plate (part of the enclosure) by conduction, i.MX 95 Tj < 105 °C. Typical internal +5–8 K; AC + charging both packs + maximum load +14–24 K Design default
• Overheat response order: charging current → backlight → CPU Design default
• Even without a fan, a "whine" can occur — power and charging circuits do not use light-load modes that drop into the audible band (fixed frequency preferred, Burst/PFM prohibited); shielded inductors and low-noise capacitors are used Design default
• Backlight uses current (analog) dimming only; no audible-band PWM path is used Design default
• Alarm sounds are excluded from the "silent" requirement (necessary sounds) Design default
• NIBP (+option) pump noise — night measurement interval and disabling automatic measurement are configurable Design default

10. Holter · trend · cloud

Confirmed (2026-10-11)

Design defaults

• Holter = continuous recording of raw waveforms → analyzed later. Trend recorder = records heart rate · SpO2 · pulse · alarms as trends over time
• The record inside the device is the master; the cloud holds a copy. In real time only status · events · trends · alarms are sent; raw waveforms are uploaded in 1-hour files
• Appended in 1-second blocks, each block with sequence number · timestamp · CRC32 · hash of the previous block (hash chain) → gaps and tampering become visible
• Stored channels: base 5-electrode 4 channels (I · II · III direct · V), 12-lead option 8 channels (I · II · V1–V6)
• Capacity: 4 channels 500 Hz · 24-bit = 518 MB per day · 3.6 GB for 7 days / 12-lead 14 days 14.5 GB → eMMC 32 GB or more
• Trend items: HR · SpO2 · PR · respiration rate (option) · PI + alarm events, 1-second resolution, graph window 30 minutes–7 days
• Derived indices: nocturnal SpO2 ODI · T90, HRV — indices derived from SpO2 are also marked "Reference value · not calibrated"
• Patient event button: physical button on the main unit + on-screen button
• Export: EDF+/BDF or WFDB-FLAC by default, ISHNE, DICOM Ambulatory
• Loss of communication does not affect measurement · recording · alarms. Wi-Fi is the primary path; BLE is for status viewing · settings
• Wired LAN is isolated with a 2 MOPP LAN transformer (ordinary 1 500 Vrms transformers prohibited)

11. Understanding of SpO2 accuracy Confirmed

• The "accuracy ±2%" in commercial probe specifications is a value for the combination of the probe + that manufacturer's monitor. It is not the performance of the probe alone
• Manufacturers do not publish the calibration curve that converts the R ratio into SpO2 %
• That curve can only be made through controlled hypoxia clinical studies under ISO 80601-2-61 → impossible for an in-house build
• The 95–100 % range can be aligned by comparison against a commercial finished oximeter as a reference
• Below 90 % there is no way to verify. Yet that is exactly the range where SpO2 matters → a line that cannot be crossed
• The two-wavelength method mistakes carboxyhemoglobin for oxygen and overestimates (commercial monitors share the same weakness)

SpO2 design defaults

• Calibration: only the 95–100 % range is compared against a commercially certified oximeter, aligning a single offset only (curve shape unchanged)
• Probe connector Nellcor-compatible DB9, LED1 = IR, LED2 = RED. Wavelengths red ~660 nm · infrared ~900 nm / 920 nm
• LED current hardware maximum 75 mA, firmware limit 50 mA (probe rating unverified)
• PRF 500 Hz, duty 25 % per LED. After measurement, the PRF is shifted so it does not interlock with isolated power supply switching
• When signal quality is low (e.g. starting value PI < 0.3 %), the number is hidden as "---" and the waveform turns gray
• A simulator cannot prove SpO2 number accuracy (used for pulse rate · low perfusion · ambient light · alarm tests)

12. Requirements specification rev3 overview (2026-10-11)

Using the confirmed specification as the development benchmark, 295 requirements were organized by category, source and verification method. IDs are "category-three-digit number" (e.g. ECG-008).

"Separate instruction" means items directly instructed outside the confirmed specification document (alarm color, screen background rules, etc.).

Verification methods

Most of the original standards (paid) could not be consulted; the "original text unverified" and "secondary source" labels next to clauses are carried over exactly as marked in the source documents.

13. Key requirements by category

Only representative items out of the 295 are listed. The status of every item is "Not yet verified" (not yet tested).

SAF — Patient safety · isolation · EMC

• Patient leakage current normal condition ≤ 10 µA (design target ≤ 5 µA) · single fault ≤ 50 µA Design default
• Total patient leakage (ECG+SpO2 group) normal ≤ 50 µA · single fault ≤ 100 µA; touch current normal ≤ 100 µA · single fault ≤ 500 µA Design default
• Dielectric strength: applied-part group ↔ system 1 500 Vrms for 1 minute. Boards that have been tested are not used on people Design default
• Pulse (front-end protection) resistors are placed on the board Confirmed
• 2-stage release of measurement while charging: stage 1 keep mechanical interlock · hardware cutoff → stage 2 release after passing measured leakage · noise tests while charging Confirmed
• ESD contact ±8 kV · air ±15 kV, radiated RF immunity 10 V/m for home environment, etc., per IEC 60601-1-2 Ed.4.1 Design default
• Only certified disposable Ag/AgCl electrodes are used Design default

ECG — ECG measurement · signal processing

• Input-referred noise ≤ 30 µV p-p, CMRR ≥ 78 dB, no saturation at input DC offset ±300 mV Design default
• Sampling ≥ 500 SPS, 24 bit per channel Design default
• Lead-off: per-electrode detection with name shown, within ≤ 10 s after disconnection (design target approx. 0.4 s) Design default
• HR = average of the last 8 RR intervals; outside the display range 30–250 bpm shows "---"; accuracy ±10 % or ±5 bpm, whichever is greater Design default
• Real-time calib amplitude monitoring: deviation ≤ 2 % OK · 2–5 % CHK · > 5 % ERR Design default
• Electrode miswiring warning ("Check LA/RA electrodes", etc.) Design default
• ST analysis remains unimplemented Design default · pacemaker pulse detection Undecided

NIBP · RESP (+option)

• A slot for the NIBP (cuff type) module is provided; design reference standard IEC 80601-2-30. Module part number undecided Confirmed Undecided
• Respiration uses the circuit built into the ECG chip; shows "Reference value" when enabled; no accuracy is claimed Confirmed
• Operates with the base configuration alone (5-electrode ECG · SpO2), with no option modules fitted Confirmed

ALM — Alarms

• IEC 60601-1-8 style alarm function included in this product, 3 levels: high · medium · low Design decision
• High-priority alarm color #FF0000 Separate instruction
• Default physiological alarm thresholds HR 50–120 bpm · SpO2 < 90 % · PR 50–120 bpm, adjustable Design default
• Asystole = high priority; HR · PR · low SpO2 = medium priority. Alarm delay ≤ 10 s, audio pause default 2 minutes Design default
• Alarm sound via speaker + synthesized waveform, main energy 500–1000 Hz (considering high-frequency hearing loss in the elderly) Design decision
• Low SpO2 alarm messages also carry "Reference value · not calibrated". No alarms are raised from arrhythmia learning-model results (recording · reference only) Design default
• Caregiver notification: app notification → text message if not acknowledged. No automatic connection to 119 (emergency services) Design decision

SEC — Security

• Update packages must be signed; installation refused if the signature is invalid (common to USB · OTA); A/B slots · automatic rollback Design default
• Per-device X.509 certificate, private key inside the secure element. Storage encryption Design default
• SBOM maintenance, threat modeling, vulnerability intake · response channel Design default
• Separate consent screen for health information collection; server access logs for sensitive data kept ≥ 2 years Design default
• Handling of updates during measurement Undecided

MNT — Maintenance · after-sales service · upgrades

• Power-on self-test (POST) — if any test fails, measurement does not start; periodic self-diagnosis during measurement Design default
• Error codes + time-stamped error log, service mode Design default
• Battery packs replaced by latch without tools; charge/discharge cycle count · health history collected Design default
• IEC 62353 periodic inspection every 12 months + after repair · drops Design decision
• Baseline leakage values recorded right after manufacture; internal pass line for periodic inspection: applied-part leakage ≤ 10 µA Design default
• Detachable processor module, measurement section on a separate board — only the processor can be replaced later Design default
• Calibration evidence uses an external simulator, not the internal test signal Design default

ACU — Acoustic noise

• There must be no audible noise; fanless by default Confirmed
• Measurement procedure: room at night with background ≤ 25 dB(A), positions at the bed head and bystander 1 m, measured per state (battery · AC · charging · screen off, etc.), tones judged by unweighted FFT Design default
• Proposed pass values: zero prominent pure tones, on/off LAeq difference at 1 m < 1 dB (not a standard value, not confirmed) Design default

14. Reference standards for design Design default

IEC 60601-1 (Ed. 3.2) · IEC 60601-1-2 (Ed. 4.1) · IEC 60601-1-6 / IEC 62366-1 · IEC 60601-1-8 · IEC 60601-1-11 · IEC 60601-2-47 · ISO 80601-2-61 · ISO 14971:2019 · IEC 62304 · IEC 81001-5-1 · IEC 62133-2.

IEC 60601-2-27 excludes home use, so it is used only as a voluntarily adopted criterion. The NIBP option uses IEC 80601-2-30, periodic inspection uses IEC 62353, and cybersecurity uses the MFDS (Ministry of Food and Drug Safety) guidance-0995-05 as a design checklist.

15. Undecided · unverified list

Undecided (15 items)

Unverified (5 items)

Other unverified values within individual requirements — such as original standard clause texts, detailed AFE159RP8 specifications and LTC1760 production status — are left as-is in each requirement.

16. Inconsistencies between documents

Inconsistencies found are only recorded; the source documents are not modified. Representative items:

• Holter loss limit on sudden power loss: ≤ 1 second / 1–2 seconds → the specification uses the larger, ≤ 2 s
• Simulator pace pulse: proposal to add an output / pulses of several hundred mV impossible with the 1000:1 structure → undecided
• SpO2 row definition: red PPG AC / red · IR overlay → undecided
• Leakage design target: 50 % / 10 % of the limit → pass is the standard limit, target is the 50 % side, the 10 % side is undecided
• SoM power: 3.55 W (typical) / measured average at maximum load 6.38 W → thermal budget re-evaluated at 6.38 W
• Pack configuration: the confirmed specification's "cell count · capacity · pack configuration undecided" stands, and 4S is a design decision (not confirmed)
• Alarm thresholds: the existence of alarms and the #FF0000 color are instructed; the threshold numbers are design defaults
• ECG chip reference values: some values such as lead-off current and CMRR calculations are based on the previous chip (ADS1298) — the corresponding values for the confirmed chip AFE159RP8 are unverified