A wearable safety beacon is “successful” only when an emergency event produces a provable device-side evidence chain: Trigger → Wake → Location → Link → Payload/Voice → Delivery Proof. This chapter defines what to measure, what must be true, and what is explicitly out-of-scope (no cloud/app walkthroughs).

Treat TTFA as a chain of observable checkpoints. Each checkpoint must have at least one “hard” signal (GPIO edge, rail step, modem status, counter) to avoid ambiguous blame.

• T0 Trigger: interrupt reason code captured (BTN_LONG / FALL_CONF / TAMPER_STRAP).
• T1 Wake: main MCU domain active (RTC → main), measured by rail step + firmware timestamp.
• T2 Location valid: GNSS fix flag OR UWB positioning valid OR last-known position with confidence & age.
• T3 Link ready: cellular attached / bearer ready OR BLE relay ready; include signal snapshot.
• T4 Payload sent: queue drained + sequence counter incremented; TX burst observed on current trace.
• T5 Delivery proof: ack/receipt flag or timeout fallback taken (device-side decision logged).

Triggers must be classified by evidence requirement and false-alarm cost. Ultra-low-power design depends on a two-stage wake approach: an always-on sensor/button interrupt only “opens a short confirmation window,” then the main system escalates to alert.

The table below is device-side only: sensors, timers, and local counters. No app/cloud workflows.

Debounce is not only “button bounce.” In field failures, “false alarms” often come from mechanical shocks, sensor saturation, or power/EMI glitches. Confirmation must separate these with minimal extra energy.

• Mechanical: use time windows + multi-evidence corroboration (peak + posture + inactivity).
• Sensor limits: track saturation/clipping flags; if saturated, extend confirm window and require post-event stillness.
• Power/EMI: log rail droop / reset counters; if droop occurs near trigger, tag event as “suspect” and avoid immediate escalation.
• User intent: for manual panic, provide a short cancel window with a deterministic pattern (press+hold to cancel).

A strict state machine reduces ambiguity. Pair every transition with a reason code so that validation, FAQs, and debug playbooks can trace real devices with Ctrl+F.

Multi-radio reliability comes from clear responsibility and measurable handoff gates. Each radio is assigned a primary job and a fallback role, while the firmware maintains two independent selectors: Location Provider (GNSS/UWB/Last-known) and Uplink Bearer (Cellular/BLE relay/Store-and-forward).

Handoffs must be driven by hard gates (timeouts, retry counts, confidence) rather than “best effort” heuristics. The goal is to avoid resource fights (RF time, current peaks) and to keep emergency paths deterministic.

• Location Provider selector: prefer GNSS when fix-quality passes threshold; else use UWB when session residual is stable; else last-known with age + confidence.
• Uplink Bearer selector: prefer cellular when bearer is ready; else BLE relay if available; else store-and-forward with bounded retry schedule.
• Priority rule: during emergency, scheduling favors the path that reduces TTFA; background scans must yield immediately.
• Exit rule: if the chosen provider fails N times or exceeds timeout, switch once and log the reason code (no infinite thrash).

When TTFA is long, the cause is usually one of: registration delay, poor RF margin, or coexistence blocking. The evidence set below is the minimum to distinguish them.

• Link budget snapshots: BLE RSSI; cellular RSRP/SINR; GNSS C/N0; UWB session RSSI/residual.
• Retry counters: attach retries, TX retries, UWB session retries, BLE reconnect attempts.
• Registration histogram: attach time distribution (best/typical/worst) + success rate in weak coverage.
• State timestamps: map radio states to T0–T5 so delays can be attributed to “fix” vs “bearer ready.”

In multi-radio wearables, failures often appear only when transmitters, antennas, and power domains operate together. The goal is to keep RF performance predictable under simultaneous activity using three levers: placement (antennas/keepouts), front-end partition (filters/LNA/switch/ESD), and coexistence scheduling (time-slicing + priority).

• LTE vs GNSS: maximize isolation; keep GNSS antenna away from LTE PA region and high di/dt converters; reserve a GNSS keepout area.
• UWB: avoid proximity to large metal (battery cans, shields); keep a stable ground reference; prefer edge placement for radiation.
• BLE: avoid detuning by battery/metal straps; leave matching network access for tuning during EVT/DVT.
• Human-body detune: validate in “worn” conditions; track RSSI/RSRP shifts and retune margin.

Front-end parts should be chosen and placed to protect weak receivers (GNSS/UWB) from strong transmitters (LTE). The aim is not perfection, but stable margins that survive worst-case bursts, temperature, and aging.

• LNA placement: shortest RF path to antenna; clean bias rail; tight return path to reduce injected noise.
• Filtering: SAW/BAW or band-pass where it materially improves desense; verify insertion loss vs isolation trade.
• RF switch / duplexer: when sharing antennas, quantify insertion loss and ensure isolation is sufficient for coexistence.
• RF ESD: use low-capacitance devices; place at the entry with controlled return path to avoid re-radiation.

• Time-slicing: schedule GNSS measurement windows away from cellular TX bursts; pause UWB sessions during high-duty BLE scans if needed.
• Priority: emergency uplink and “proof-of-delivery” outrank background scans; prevent thrash loops by logging fallback reasons.
• Notch/filter strategy: apply only when tests show measurable improvement; otherwise keep the RF chain simpler.
• Return path discipline: route high di/dt loops away from RF; correlate near-field hotspots with receiver quality loss.

• Desense test: record GNSS C/N0 and fix rate while forcing cellular TX bursts; overlay time markers to prove causality.
• UWB degradation test: range residual / session fail rate vs BLE scan/connect duty; identify thresholds where errors jump.
• Near-field scan: find hotspots near PA/DC-DC/feeds; correlate with conducted/radiated emissions and receiver loss.
• “Worn” detune: repeat RF metrics with body proximity; compare to bench and adjust matching/placement margins.

Emergency voice must remain intelligible and continuous while the device is power-limited and radios may be struggling. This chapter defines the voice chain as a set of gated stages (wake → capture → enhance → encode → deliver/play) and ties each stage to measurable evidence: mic SNR, clipping/AGC counters, (optional) AEC convergence indicators, end-to-end latency, and dropout rate.

• Wake strategy trade: wake-on-voice can drain battery via false wakes; button-only is deterministic but requires user action.
• Tiny-speaker feedback risk: small transducers + enclosure leakage can cause howl/echo; the chain needs bounded gain and observable convergence.
• Poor-link scheduling: when cellular retries spike, RF time and peak current compete with audio; emergency policy must preserve voice continuity.
• Wind + friction noise: outdoor turbulence and body contact can saturate the mic/AFE; clipping control is as important as noise reduction.

Emergency mode should enforce a simple rule set that is provable by logs: voice frames are scheduled first, telemetry yields, and the system avoids thrashing when the link is unstable.

• Priority ladder: voice audio frames → delivery proof/ack metadata → location updates → non-critical telemetry.
• Bounded retries: if modem retries exceed a threshold, reduce telemetry frequency and protect audio buffers.
• Gain bounding: cap speaker/PA gain steps in emergency to prevent runaway feedback; log limiter hits.
• Fail-soft: if voice delivery degrades, fall back to short siren/beep patterns + minimal metadata payload (device-side behavior only).

Safety beacons must survive a power paradox: µA sleep for months, then high peak current during cellular TX bursts, GNSS acquisition, and speaker/siren drive. The power tree must be partitioned into sleep islands and peak domains, with buffers and bounded inrush so that emergency events do not cause brownouts.

• Sleep islands: RTC domain, wake controller, sensor hub, secure element keep-alive; ensure no back-powering through I/O.
• Peak handling: modem/PA TX bursts, GNSS acquisition, speaker/siren; keep peak paths isolated from always-on rails.
• Energy storage: Li-ion vs primary cell behavior under burst load; supercap buffers; bounded inrush charging.
• Fuel gauge correctness: separate ESR droop from true SoC; avoid false “empty” or sudden shutdown under bursts.

• Current profile: sleep (µA) / scan (mA) / TX burst (A peaks) / audio (hundreds mA) — capture with time alignment.
• Rail droop: modem rail min voltage during worst burst; MCU rail min voltage; log reset reason codes.
• Brownout margin: worst-case ESR (cold + aged) model vs measured droop; verify UVLO thresholds and hysteresis.
• Inrush evidence: supercap charge current limit effectiveness; prove it does not trigger brownout at plug-in or wake.
• Fuel gauge sanity: SoC estimate stability during bursts; track “voltage sag vs SoC” correlation to prevent misreporting.

A robust pattern is to keep the always-on domain clean and minimal, then feed the modem/PA domain from a buffered branch. A supercap (or high-burst reservoir) can be OR-ed into the modem rail through an ideal-diode element, while inrush limiting prevents “buffer charging” from collapsing the system.

• Domain switches: load switches per domain to prevent leakage and back-power.
• Buffered modem rail: reservoir energy supports TX bursts without dragging down MCU/RTC rails.
• Bounded inrush: current limit + soft-start for supercap to avoid startup brownouts.
• Reason codes: log UVLO/brownout, watchdog, and modem fault states to separate power vs firmware issues.

Trigger robustness is a system problem: an always-on sensor hub must wake the main MCU quickly, then a short confirmation window must discriminate real events from daily motion. This chapter fixes the chain as two-stage wake (threshold wake → confirm pipeline) and forces every decision to produce evidence: raw accel window + rail droop snapshot + reason/confidence codes.

• Accelerometer ODR & range: choose a low ODR for always-on thresholding, then raise ODR only inside the confirmation window.
• Thresholds + persistence: use a duration gate to avoid micro-spikes; track peak-g and duration as evidence.
• Orientation compensation: measure posture change (delta angle) to avoid “running vibration” masquerading as a fall.
• Motion classification (minimal set): a small feature set (impact peak, decay, posture flip, band energy) beats opaque heuristics.
• Strap / tamper debounce: treat strap removal and enclosure open as state machines with bounded debounce time.

Robust triggers require per-class accounting. A minimal confusion matrix should include: true fall, running, vehicle vibration, stairs/jumps, and drop-on-table. The goal is not perfect classification; the goal is bounded false alarms while keeping missed critical events near zero.

• True fall: single impact peak + posture flip + short stillness window (often).
• Running: periodic energy with stable orientation; reject via cadence-like band energy signature.
• Vehicle vibration: low-frequency sustained energy, minimal posture change; reject via decay and orientation gates.
• Desk drop: large impact peak but inconsistent posture + immediate subsequent motion; reject via post-impact pattern.

Location is only useful when its quality is explicit. This chapter defines a device-side location contract: every update carries a timestamp, source tag, confidence score, and fix age. GNSS, UWB ranging, and IMU-assisted dead-reckoning contribute as evidence-driven inputs, and fusion must degrade gracefully when any source weakens.

• GNSS start reality: cold vs warm start distributions; aiding retention reduces TTFF only when state is preserved and antenna noise is controlled.
• Antenna matching impact: degraded matching and desense show up as lower C/N0, fewer satellites, higher HDOP, and longer TTFF.
• UWB error sources: clock offset and multipath dominate; use range residuals and session success ratio to bound trust.
• Fusion rules: weight inputs by their quality metrics; confidence must drop when fix age grows or residuals rise.
• Dead-reckoning role: bridge short gaps and smooth transitions; never hide drift—expose it via confidence and fix age.

• Indoor transition: GNSS quality drops (C/N0↓, HDOP↑) → down-weight GNSS; rely more on UWB residual-bounded updates.
• UWB multipath: residuals spike or sessions fail → reduce UWB weight; hold last-known with explicit fix_age growth.
• All weak: both GNSS and UWB unreliable → DR bridges briefly; confidence decays with dr_age_ms and fix_age_ms.
• Never hide staleness: last-known must carry fix_age_ms and low confidence to prevent silent misinterpretation.

The goal is simple and measurable: only signed firmware runs, keys never leave protected hardware, and every alert can carry a device-side trust state. This chapter stays strictly on the device: secure boot, rollback prevention, key vault / secure element boundaries, and integrity signals that reduce spoofing or tampering without cloud dependency.

• ROM root: immutable boot ROM (or equivalent) must be the first verifier of the next stage.
• Signed firmware: verify signature before execution; log the verify result and fail reason.
• Rollback protection: prevent “valid but older” images using monotonic counters or version fuses/secure storage.
• Runtime trust state: expose a compact attestation flag to be attached to alert payloads (device-side only).

• Key vault / secure element: keys live in protected silicon; crypto operations occur inside the vault/SE.
• Access control: separate key usage domains (identity, message auth, encryption) and track per-domain access counters.
• eSIM/iSIM: treat cellular identity credentials as hardware-isolated assets; keep interfaces narrow and auditable.
• Least disclosure: store only what the device must send (e.g., location + timestamp); avoid local caches that increase leakage risk.

Spoof resistance is bounded by power and form factor. The goal here is not perfect prevention, but detect-and-downgrade trust. When integrity signals degrade, the device should reduce location confidence, tag alerts accordingly, and avoid silently presenting stale or suspicious fixes.

• GNSS anomaly hints: sudden C/N0 pattern changes, unrealistic speed/accel, frequent fix-type toggling → spoof_suspect flag.
• UWB integrity hints: residual spikes, session failures/retries, abrupt range jumps → down-weight UWB contribution.
• Trust downgrade: confidence score and fix_age are the public truth; suspicious inputs must not look “normal.”

Ruggedization is not “add a TVS and hope.” It is an entry-point and return-path discipline: identify where energy enters (buttons, mic/speaker ports, RF feed, pads/cables), constrain where it returns, and protect the true victims (reset stability, RF sensitivity, GNSS acquisition, and emergency audio clarity). This chapter maps the hardening targets to measurable before/after evidence.

• ESD at buttons: clamp at the perimeter and keep discharge current out of sensitive reference grounds.
• Mic / speaker ports: treat apertures as ESD/EMI entry paths; protect nearby traces and bias networks.
• RF feed & antenna region: front-end ESD and filtering must avoid degrading sensitivity; keep return paths short and controlled.
• Pads / cables (if any): cable events inject surge/EFT-like energy; protect at connector and isolate fast edges from core rails.
• Environmental limits: low temperature raises battery ESR (droop during bursts); moisture/sweat increases leakage and bias drift.

• Buzz during TX: correlate audio noise bursts with modem TX scheduling; confirm whether coupling is via rails, ground, or near-field.
• Pop/click: check gain/AGC steps and rail droop at the same moment; “pop” is often a power integrity symptom.
• Isolation tactics (device-side): separate decoupling islands for audio; control return paths; avoid sharing high di/dt loops with mic bias.