A distributed regulation method with multi-level arbitration mechanism

Abstract

The present application relates to the technical field of distributed system control, and proposes a distributed regulation and control method with a multi-level arbitration mechanism, which comprises: a physiological safety mandatory layer that collects physiological parameters of a user in real time and calculates physiological safety thresholds; a remote strategy mediation layer that generates a regulation and control strategy proposal based on analysis of historical data and historical trends of the user; an execution arbitration layer that receives the regulation and control strategy proposal and acquires the physiological safety thresholds currently output by the physiological safety mandatory layer; the execution arbitration layer compares target parameters in the regulation and control strategy proposal with the physiological safety thresholds; if the target parameters are within the range of the physiological safety thresholds, the execution arbitration layer generates an execution driving signal; if the target parameters exceed the range of the physiological safety thresholds, the physiological safety mandatory layer blocks or degrades execution of the regulation and control strategy proposal through a hardware-level veto mechanism; wherein the hardware-level veto mechanism operates independently of the remote strategy mediation layer and the execution arbitration layer and has the highest priority.

Description

Technical Field

[0001] This invention relates to the field of distributed system control technology, and in particular to a distributed control method with a multi-level arbitration mechanism. Background Technology

[0002] Existing medical IoT control systems generally adopt a flat control architecture that combines cloud-based intelligent decision-making with local execution mechanisms. A remote server generates control strategies based on historical data and directly sends them to local devices for execution, with local devices only setting static absolute thresholds as a final safety measure. However, this architecture has fundamental flaws: static thresholds cannot adapt to the dynamic changes in a patient's physiological state. Under different physiological loads such as exercise and stress, fixed thresholds are either too conservative, leading to treatment failure, or too aggressive, creating safety hazards. The unavoidable network latency in cloud-based decision-making means that the patient's physiological state has already changed by the time the command arrives, causing a time misalignment between remote control intentions and real-time local physiological needs. More seriously, existing systems lack an unassailable hierarchical arbitration mechanism; the cloud often holds the highest authority and can override local security settings through remote commands. Once hijacked or the algorithm malfunctions, the local device will lose its ability to defend itself. These problems collectively lead to uncontrollable physiological safety risks in complex physiological coupling and network environments. Summary of the Invention

[0003] To address the aforementioned shortcomings, the present invention aims to propose a distributed control method with a multi-level arbitration mechanism. This method constructs a defense-in-depth architecture consisting of a physiological safety enforcement layer, a remote policy adjustment layer, and an execution arbitration layer. It grants the physiological safety enforcement layer hardware-level veto power based on real-time physiological parameter calculations, thereby achieving absolute priority of physiological safety constraints over remote optimization instructions in distributed control. This avoids physiological safety incidents caused by flattened permissions, state mismatch, or network latency.

[0004] To achieve this objective, the present invention adopts the following technical solution: A distributed control method with a multi-level arbitration mechanism is disclosed. This multi-level arbitration control method is applied to a multi-level arbitration control system including a physiological safety enforcement layer, a remote strategy mediation layer, and an enforcement arbitration layer. The multi-level arbitration control method includes the following steps: S1: The physiological safety enforcement layer collects the user's physiological parameters in real time and calculates the physiological safety threshold based on the physiological parameters; S2: The remote strategy mediation layer generates a regulation strategy proposal for optimizing the effect of physiological regulation based on the analysis of user historical data and historical trends, and sends the regulation strategy proposal to the execution arbitration layer; S3: The arbitration layer receives the proposed regulation strategy and obtains the physiological safety threshold currently output by the physiological safety enforcement layer; S4: The arbitration layer compares the target parameters in the proposed regulation strategy with the physiological safety threshold. S5: If the target parameter is within the physiological safety threshold range, the execution arbitration layer generates an execution drive signal to execute the regulation strategy proposal; If the target parameter exceeds the physiological safety threshold range, the physiological safety enforcement layer blocks or downgrades the execution of the regulation strategy proposal through a hardware-level veto mechanism. The hardware-level veto mechanism operates independently of the remote policy mediation layer and the execution arbitration layer, and has the highest priority.

[0005] Preferably, step S1 includes: The physiological safety mandatory layer collects physiological parameters including heart rate and blood pressure; The load index, which reflects the user's overall physiological state, is calculated based on the physiological parameters. The calculation of the load index is based on the deviation of the physiological parameters from historical benchmarks and preset weights. Based on the comparison results between the load index and the preset first decision threshold and second circuit breaker threshold, the physiological safety threshold is determined: When the load index is lower than the first decision threshold, the physiological safety threshold is the preset maximum safe output value; When the load index is between the first decision threshold and the second circuit breaker threshold, the physiological safety threshold decreases as the load index increases; When the load index is not lower than the second circuit breaker threshold, the physiological safety threshold is set to zero.

[0006] Preferably, the hardware-level veto mechanism includes: When the physiological safety enforcement layer determines that execution needs to be blocked based on the comparison result of the load index, it directly outputs a control signal through the GPIO pin of the independent microcontroller of the physiological safety enforcement layer. The control signal is transmitted to the hardware enable terminal of the power amplifier in the physical execution unit, and the control signal is logically ANDed with the drive signal from the execution arbitration layer; The physiological safety enforcement layer unconditionally blocks the execution of the proposed control strategy by physically cutting off the power supply path of the power amplifier by pulling the control signal down to an invalid level.

[0007] Preferably, the physiological safety enforcement layer periodically performs the acquisition of the physiological parameters and the calculation of the physiological safety threshold at a preset high-frequency sampling period; The total time taken by the physiological safety enforcement layer from collecting physiological parameters to triggering the hardware-level veto mechanism is shorter than the time required for the control strategy proposal generated by the remote policy mediation layer to be sent to the execution arbitration layer.

[0008] Preferably, based on the analysis of user historical data and historical trends, the proposed regulatory strategies for optimizing the effects of physiological regulation include: The remote policy mediation layer is located on a cloud or edge server; The remote strategy adjustment layer uses a built-in artificial intelligence optimization model to perform big data analysis on the user's historical data and generate personalized treatment plans, including target intensity and duration, as the adjustment strategy proposal. The proposed control strategy is sent unidirectionally to the execution arbitration layer via the network transmission channel, and the remote strategy mediation layer is only granted suggestion authority and does not have any ability to directly control the physical execution unit.

[0009] Preferably, step S3 includes: The physiological safety threshold output by the physiological safety enforcement layer is stored in a local read-only register or output through a separate hardware enable pin, and the execution arbitration layer reads it directly through a hardware-level interface.

[0010] Preferably, in step S5, the arbitration layer includes: The execution arbitration layer generates the execution drive signal only when the regulation strategy proposal conforms to the preset format and permissions, and its target intensity parameter is within the range limited by the physiological safety threshold. After generating and outputting the execution drive signal, the execution arbitration layer enters a continuous monitoring loop and continuously reads the status of the physiological safety enforcement layer at a frequency not less than the sampling period of the physiological safety enforcement layer. Once a hardware rejection signal or software stop flag is detected by the physiological safety enforcement layer during the continuous monitoring cycle, the execution arbitration layer immediately stops outputting the execution drive signal and forcibly jumps to the safety blocking state.

[0011] Preferably, the physiological safety enforcement layer has built-in adjudication benchmark parameters, including preset weights for calculating the load index, historical benchmark mean and standard deviation of physiological parameters, the first adjudication threshold and the second circuit breaker threshold, all of which are permanently stored in the read-only memory of the physiological safety enforcement layer. The remote policy mediation layer has only read access to the read-only memory that stores the adjudication benchmark parameters, and cannot perform any remote write or modification operations on it.

[0012] Preferably, step S1 further includes sensor fault safety handling logic: The physiological parameters were collected by a physiological parameter sensor; The physiological safety enforcement layer continuously monitors the signal quality of the connected physiological parameter sensors; When any physiological parameter sensor signal is lost or the signal-to-noise ratio is lower than the preset quality threshold, the preset fault safety strategy is automatically executed. The fail-safe strategy includes adjusting the preset weights of the corresponding physiological parameters to zero and recalculating the physiological safety threshold based on the preset minimum safety value or the remaining effective parameters.

[0013] One of the above technical solutions has the following advantages or beneficial effects: This invention elevates physiological monitoring, traditionally considered an auxiliary examination item in systems, to a top-priority decision-making basis by independently executing physiological parameter acquisition and dynamic safety threshold calculation through a mandatory physiological safety layer. The output safety threshold changes in real-time with the patient's physiological load, thus overcoming the inherent limitation of static thresholds in adapting to individual differences and sudden changes in condition. Secondly, the remote strategy mediation layer is strictly limited to strategy proposal generation nodes with only suggestion permissions. Its role is downgraded from the "highest decision-maker" in the traditional architecture to an "optimization suggestion provider." This structural permission isolation fundamentally avoids the risk of remote hijacking or algorithm malfunction leading to the passive execution of dangerous commands by local devices. Furthermore, upon receiving a remote proposal, the execution arbitration layer must execute a mandatory verification process of "reading the first-level safety threshold → comparing target parameters → conditional execution." This logical chain ensures that no regulatory intent can bypass the review of the real-time physiological safety boundary, achieving unbypassable proposal filtering. Most importantly, when the comparison results show that the target parameter exceeds the limit, the physiological safety enforcement layer, through a hardware-level veto mechanism independent of the software logic layer, directly cuts off the power supply path of the actuator physically. This hardware-level veto mechanism does not involve upper-layer instruction transmission and has the highest priority at the architectural level, ensuring that even if network latency causes harmful instructions to be transmitted locally, or the algorithm model generates extreme parameters, the system can still complete the blocking before a substantial deterioration in the physiological state occurs, thus achieving immunity to network latency in terms of timing. In summary, this invention establishes an uncoverable multi-layered defense depth by sinking physiological safety verification from a parallel software inspection stage to a low-level physical constraint mechanism. This ensures that the control execution is always under the absolute control of the real-time physiological safety boundary, effectively solving the physiological safety risks caused by flattened permissions, state mismatch, and network latency. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0015] Figure 1 This is a flowchart of a distributed control method with a multi-level arbitration mechanism provided in an embodiment of the present invention; Figure 2 This is the architecture and data flow diagram of the multi-level arbitration and control system provided in the embodiments of the present invention; Figure 3 This is the multi-level arbitration logic and dynamic security window calculation provided in the embodiments of the present invention; Figure 4 This is a schematic diagram of timing comparison and fault interception provided in an embodiment of the present invention; Figure 5 This is the arbitration state machine transition diagram provided in the embodiment of the present invention. Detailed Implementation

[0016] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0017] In this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0018] A distributed control method with a multi-level arbitration mechanism, such as Figure 1 As shown, in a preferred embodiment of the present invention, the multi-level arbitration control method is applied to a multi-level arbitration control system including a physiological safety enforcement layer, a remote strategy mediation layer, and an execution arbitration layer. The multi-level arbitration control method includes the following steps: S1: The physiological safety enforcement layer collects the user's physiological parameters in real time and calculates the physiological safety threshold based on the physiological parameters; It should be noted that the physiological safety enforcement layer refers to an independent hardware control unit deployed on the local medical IoT device. This unit includes a dedicated microcontroller, physiological sensor interfaces, and hardware-level protection circuitry. Its function is to ensure that physiological safety constraints are not interfered with by upper-layer software or network commands through a physical isolation mechanism. Physiological parameters refer to multi-dimensional vital sign data that reflect the user's physiological state, including but not limited to heart rate (HR, beats / minute), systolic / diastolic blood pressure (BP, mmHg), respiratory rate (RR, breaths / minute), and blood oxygen saturation (…). (unit: percentage), these parameters are connected via hardwired methods (e.g. The data is transmitted directly from the bus (or SPI bus) to the microcontroller in the physiological safety enforcement layer, without passing through the operating system scheduling layer. The physiological safety threshold refers to the dynamically calculated maximum allowable output intensity boundary value, quantified in terms of voltage amplitude or current intensity, and expressed as... Its calculation is based on a weighted fusion algorithm of multidimensional physiological parameters. Real-time acquisition refers to continuously acquiring physiological sensor data at a frequency of no less than 10Hz, with the sampling period strictly controlled within 100 milliseconds to ensure millisecond-level response capability to physiological changes. The calculation process refers to the dedicated algorithm execution unit built into the physiological safety enforcement layer performing sliding window filtering (window length 5 seconds), standardization (z-score standardization), and weighted summation on the acquired raw data, ultimately generating a safety boundary value reflecting the current physiological load.

[0019] Understandably, step S1, by designing the physiological safety enforcement layer as an independent hardware entity, achieves a localized closed loop for physiological data acquisition and calculation, avoiding interference from cloud network latency on the safety response. The physiological safety enforcement layer continuously monitors the user's physiological state at an extremely high sampling frequency, enabling hazard identification and safety threshold updates within a millisecond-level time window after a physiological mutation occurs. This high-frequency monitoring mechanism ensures that the system always generates protection boundaries based on the latest physiological state. The significance of dynamically calculating the physiological safety threshold lies in overcoming the limitation of traditional static safety thresholds in adapting to changes in physiological load. By real-time fusion of multi-dimensional parameters and the introduction of historical benchmark deviation analysis, the system can accurately perceive the safety boundary drift of users in different physiological scenarios (such as rest, exercise, and stress), thereby generating protection thresholds that match the current physiological state. This design fundamentally solves the shortcomings of overly conservative or aggressive static thresholds in the background technology, providing precise safety constraints for subsequent arbitration decisions.

[0020] S2: The remote strategy mediation layer generates a regulation strategy proposal for optimizing the effect of physiological regulation based on the analysis of user historical data and historical trends, and sends the regulation strategy proposal to the execution arbitration layer; It should be noted that the remote strategy adjustment layer refers to the strategy generation unit deployed on a cloud server or edge computing node. This unit connects to local devices via a wide area network (WAN) or local area network (LAN) and is responsible for using big data analytics and artificial intelligence models to uncover long-term patterns in user treatment data. User historical data refers to multi-dimensional information stored in a cloud database, including long-term physiological records, treatment response logs, device usage habits, and environmental factors (such as time and season), typically spanning at least 30 days. Historical trends refer to periodic patterns, gradual changes, or sudden anomalies identified from user historical data through time series analysis methods. For example, a user's heart rate may regularly increase between 3 PM and 5 PM daily, or blood pressure may show a step-like decrease after medication. The regulation strategy proposal refers to the strategy generated by the remote strategy adjustment layer, which includes the target output intensity. Treatment recommendations based on a set of parameters such as duration and frequency are encapsulated in a structured data packet. Essentially, they are optimization suggestions rather than control instructions. Optimizing physiological modulation effects refers to using machine learning models to predict the optimal combination of stimulation parameters to improve treatment effectiveness, reduce the incidence of side effects, and enhance user experience. Sending to the execution arbitration layer refers to the remote policy mediation layer unidirectionally transmitting the policy proposal to the local execution arbitration layer via network communication protocols (such as MQTT or HTTPS). The transmission process includes authentication, data encryption, and integrity verification.

[0021] Understandably, step S2, by decoupling the strategy generation function from the local device and entrusting it to the resource-rich cloud, allows the local device to focus on real-time security monitoring, achieving functional decoupling and optimized resource allocation. The remote strategy adjustment layer utilizes massive historical data and complex AI models (such as Long Short-Term Memory networks (LSTM) or Random Forests) for offline training and online prediction, enabling it to identify individualized treatment response patterns and generate more accurate and personalized regulatory suggestions than local static rules. This design separates the two core functions of "intelligent decision-making" and "security assurance" into different layers. The remote strategy adjustment layer focuses on optimizing treatment effects without considering real-time security constraints, thus fully leveraging cloud computing power; while the local physiological safety enforcement layer focuses on millisecond-level security responses without bearing complex computational loads. This architecture retains the advantages of cloud intelligence while avoiding direct interference from cloud commands to local security through hierarchical isolation, effectively solving the security risks caused by the flattened permission structure in the background technology.

[0022] S3: The arbitration layer receives the proposed regulation strategy and obtains the physiological safety threshold currently output by the physiological safety enforcement layer; It should be noted that the execution arbitration layer refers to the integrated decision-making unit deployed within the local terminal controller. This unit is responsible for coordinating conflicts between remote policy recommendations and local security constraints, and generating the final driving signal. Receiving regulation policy proposals refers to the execution arbitration layer receiving data packets from the remote policy mediation layer via the network communication module, and performing integrity checks (such as CRC checks) and authorization checks (such as digital signature verification) on the data packets to ensure the proposal's legitimacy and lack of tampering. Obtaining physiological safety thresholds refers to the execution arbitration layer directly reading the physiological safety enforcement layer's calculations and storage in read-only registers via a hardware interface (such as memory-mapped I / O or a dedicated bus). The value is read without any software intermediary layer, ensuring that the latest calculation result from the first level is obtained. The current output refers to the result generated by the physiological safety enforcement layer at the end of the most recent sampling period (100ms). This value reflects the user's current and most recent physiological safety boundary. This acquisition mechanism ensures that the execution arbitration layer always bases its execution decisions on safety thresholds that are synchronized with the user's real-time physiological state, rather than on outdated historical data.

[0023] Understandably, this step achieves temporal alignment and coupling by designing the reception of remote policy proposals and the acquisition of local security thresholds as parallel operations. The arbitration layer immediately reads the latest data the moment the remote command arrives. This design ensures the synchronization of two types of key information (remote suggestions and local constraints) at the moment of decision-making. This information is obtained directly through a hardware interface. This avoids the risks of delays or tampering that may be introduced when data is transmitted at the software layer, ensuring the credibility and timeliness of security information. The execution arbitration layer, as the final decision-making hub, must base its decisions on both remote intelligent optimization suggestions and local rigid security constraints. This dual-input mechanism ensures that decisions are both intelligent and secure. Step S3 completes the crucial task of aligning the outputs of the two layers in terms of timing and logic, laying the information foundation for subsequent security window comparison and effectively solving the timing misalignment problem between remote commands and local states in the background technology.

[0024] S4: The arbitration layer compares the target parameters in the proposed regulation strategy with the physiological safety threshold. It should be noted that the target parameter refers to the physical quantity to be executed in the proposed control strategy, which in the context of neural stimulation usually refers to the stimulation intensity. (Expressed as a percentage or voltage value), this parameter reflects the intensity of the therapeutic effect expected by the remote strategy modulation layer. The physiological safety threshold refers to the physiological safety mandatory layer dynamically calculated... This value represents the maximum safety threshold allowed under the current physiological state. Comparison refers to the logical judgment operation performed by the arbitration layer to determine the numerical relationship, specifically through comparison. and The comparison determines whether the former falls within the allowed range defined by the latter. The main body of the comparison is the comparator circuit or comparison instruction within the arbitration layer. This operation is performed in the arithmetic logic unit (ALU), and the execution time is typically a single clock cycle (nanoseconds). The comparison result produces a Boolean output: when... Output a "pass" signal when execution is allowed; when A "reject" signal is output, triggering the blocking logic. The core mathematical relationship of the comparison operation is an inequality judgment, which is the sole basis for all subsequent execution or blocking decisions.

[0025] Understandably, by rigorously comparing target parameters with physiological safety thresholds, quantitative conflict detection between remote intelligent suggestions and local safety constraints is achieved. The essence of the comparison operation is to perform a boundary condition check to determine whether the remote optimization suggestion exceeds the current physiological safety window. This check transforms abstract safety policies into executable numerical judgments. The comparison result is output in a binary logic form, simplifying decision-making complexity and ensuring that the system either fully executes safe instructions or completely blocks dangerous instructions, without any ambiguous intermediate states. The comparison operation is executed immediately after parameter acquisition, with extremely low latency, ensuring agile decision-making. This comparison mechanism endows the physiological safety threshold with the ability to prune remote instructions, enabling safety constraints to act on the execution process in real time, effectively solving the problem in the background technology where static thresholds cannot dynamically adapt to changes in physiological load.

[0026] S5: If the target parameter is within the physiological safety threshold range, the execution arbitration layer generates an execution drive signal to execute the regulation strategy proposal; If the target parameter exceeds the physiological safety threshold range, the physiological safety enforcement layer blocks or downgrades the execution of the regulation strategy proposal through a hardware-level veto mechanism. The hardware-level veto mechanism operates independently of the remote policy mediation layer and the execution arbitration layer, and has the highest priority.

[0027] It should be noted that the execution of the exponentially quantified pulse control sequence of the drive signal, which includes parameters such as voltage amplitude, pulse width, frequency, and duration, is used to directly drive the power amplifier circuit in the physical execution unit. The target parameters are within the physiological safety threshold range, which is related to the mathematical relationship. This is considered valid; at this point, the remote suggestion is deemed safe and can be executed under the current physiological state. Generating the execution drive signal indicates that the execution arbitration layer will... The value is converted into specific hardware control instructions, which are then used to generate analog voltage waveforms via a digital-to-analog converter (DAC) or to send pulse parameter configurations via a digital interface. Executing the modulation strategy proposal involves applying the generated drive signal to the physical execution unit, causing the stimulation energy to act on the user's physiological tissues. The target parameter exceeding the physiological safety threshold range refers to the mathematical relationship... Established, at this point the remote suggestion is considered to exceed the current physiological safety boundary. The hardware-level veto mechanism refers to the physiological safety enforcement layer directly controlling the enable pin of the power amplifier through independent hardware circuitry. This mechanism does not rely on software instructions and achieves physical disconnection through GPIO level signals. Blocking refers to completely terminating the execution process, reducing the actual output strength to zero. Degradation refers to reducing the execution strength from... Forced downgrade to The hardware-level veto mechanism operates independently of the remote policy mediation and arbitration layers, meaning its triggering and execution do not depend on any upper-level software state. Even if the upper-level software crashes or becomes uncontrollable, the hardware circuitry can still operate independently. "Highest priority" means that in the arbitration logic, the hardware-level veto signal has an absolute advantage that cannot be overridden by software. When any other signal is logically ANDed with this veto signal, if the veto signal is at an invalid level, the final output will be zero.

[0028] Understandably, the conditional branching logic implements two modes: normal execution within the safety window and mandatory protection outside the safety window. When the target parameters are within the safety range, the system fully utilizes cloud-based intelligent optimization capabilities, executing treatment according to remote suggestions to maximize treatment effectiveness. When the target parameters exceed the safety range, the system immediately switches to protection mode, blocking or downgrading execution through a hardware-level veto mechanism to ensure physiological safety is not compromised. The independent design of the hardware-level veto mechanism constructs a physically isolated security defense. Even if the remote policy adjustment layer generates extremely dangerous parameters due to algorithm errors or malicious attacks, or even if the execution arbitration layer's software logic has vulnerabilities, the physiological safety enforcement layer can still unconditionally cut off the output through independent hardware circuitry. This defense-in-depth architecture fundamentally avoids the risk of privilege abuse. The highest priority setting clearly defines the absolute status of security constraints in all decisions; any intelligent optimization must yield to the bottom line of physiological safety, effectively addressing the core defect in the background technology where cloud permissions can override local security settings.

[0029] like Figure 2As shown, the top layer is a cluster of physiological sensors, including heart rate, blood pressure, and respiration sensors (all with a 10Hz sampling rate). Data is transmitted to the first layer via I2C / SPI hardwired connections to ensure real-time acquisition. The blue area on the left is the second layer (remote strategy adjustment layer), deployed on cloud / edge servers. It generates control suggestions (Vsuggest) through a one-way process of "cloud server - big data processing - AI optimization model - treatment plan suggestion," which is then transmitted to the third layer via the network. It only has the right to make suggestions and has no direct control. Below are the third layer (execution arbitration layer) and the bottom physical execution unit. The execution arbitration layer integrates the signals of the first two layers through AND gate logic. The power amplifier enable terminal of the physical execution unit is directly controlled by the hardware signals of the first layer. The bold solid line path led out from the first layer realizes "hardware-level disconnect veto," bypassing the intermediate layers and highlighting its absolute control over the physical execution unit.

[0030] like Figure 3 As shown, the pink physiological safety layer (first level) on the right collects parameters such as heart rate, blood pressure, and blood oxygen at a high frequency of 200Hz. After noise is removed by a 5-second sliding window filter, it first passes the absolute boundary check of HR 60-180 beats / minute and SBP 90-160mmHg, and then calculates the comprehensive physiological load index k. Based on the relationship between k and kth1 and kth2, it divides the area into a safe zone (Vsafe=Vmax), a warning zone (Vsafe linearly decays), and a danger zone (Vsafe=0, triggering hardware circuit breaker). All areas record anti-tampering logs and send a STOP flag, with a response time of only 80ms. The light blue remote policy adjustment layer (second level) in the upper left corner generates a control policy containing the target strength and duration, which is transmitted over the network (delay > 200ms) to the third level. The instruction is only advisory. The light green execution arbitration layer (third level) in the lower left corner receives the remote instruction at time t, immediately reads the real-time Vsafe of the first level, and judges it by comparing "Vtarget ≤ Vsafe". If it is legal, it executes according to the target strength and continuously monitors the STOP flag. If it violates the rule, it clamps the output to the Vsafe level. In both cases, a security interception event is reported to the cloud. Finally, the control is completed through the actuator drive circuit.

[0031] like Figure 4 As shown, at t=0ms, the cloud sends a remote control command with an intensity of 85%, and the network transmission delay reaches 250ms; at t=50ms, the physiological sensor detects an abnormal increase in heart rate and blood pressure, and the LSU immediately starts to respond, completes the load factor calculation (k>kth2) at t=80ms, updates the safety threshold Vsafe=0 and sends a rejection signal, with a total response time of only 80ms; at t=250ms, the remote command reaches the execution arbitration layer, the arbitration layer reads the current Vsafe=0, determines that the command is in violation, forces the output to be zero, successfully blocks the high-risk output and reports the reason for the interception to the cloud. Figure 4 The bottom section highlights the core advantage of this invention by comparing it with a scenario without an arbitration mechanism (risk lasting 270 seconds): the local LSU response time (80ms) is much smaller than the network latency (250ms), achieving "early defense" before remote commands arrive, thus avoiding security risks in terms of timing.

[0032] like Figure 5 As shown, starting from the "standby state" after initialization, the system can enter the "remote command receiving" state by receiving remote control commands (command parsing requires a network latency >200ms). After local rule verification (format and permission checks), valid commands enter the core "physiological safety verification" state (marked by a dashed box). The first-level LSU performs real-time physiological parameter acquisition and safety threshold comparison. If the verification is successful (Vtarget≤Vsafe, response time≤100ms), the system enters the "execute control" state; otherwise, it enters the "command rejected" state (logging and feedback to the cloud before returning to standby). The execute control state includes a continuous monitoring closed loop with a 100ms sampling period, monitoring heart rate, blood pressure, and load coefficient in real time. If normal, the system maintains output; if a physiological mutation is detected (k≥kth2), the highest priority emergency blocking state is triggered (forced jump via bold path, with hardware-level physical blocking characteristics), and finally, the system returns to standby. Figure 5 The highlighted yellow area emphasizes the crucial role of real-time monitoring during LSU core verification and execution. Figure 5 The core characteristics of emergency blocking are summarized.

[0033] Preferably, step S1 includes: The physiological safety mandatory layer collects physiological parameters including heart rate and blood pressure; The load index, which reflects the user's overall physiological state, is calculated based on the physiological parameters. The calculation of the load index is based on the deviation of the physiological parameters from historical benchmarks and preset weights. Based on the comparison results between the load index and the preset first decision threshold and second circuit breaker threshold, the physiological safety threshold is determined: When the load index is lower than the first decision threshold, the physiological safety threshold is the preset maximum safe output value; When the load index is between the first decision threshold and the second circuit breaker threshold, the physiological safety threshold decreases as the load index increases; When the load index is not lower than the second circuit breaker threshold, the physiological safety threshold is set to zero.

[0034] It should be noted that the load index refers to a quantitative indicator that integrates multidimensional physiological parameters into a single value through a weighted algorithm. It is used to characterize the user's current overall physiological load level and is denoted as the k-value in this embodiment. Its mathematical essence is a standardized weighted sum of physiological biases. The historical baseline refers to the statistical baseline of normal physiological parameters established through long-term monitoring of a specific user, including historical averages. Compared with historical standard deviation ,in This reflects the user's normal physiological level. This reflects the individual fluctuation range of physiological parameters. The preset weights refer to the set of coefficients reflecting the contribution of each physiological parameter to safety risk, denoted as... The weights are determined through offline machine learning model training and stored in hardware storage to ensure that different parameters have differentiated sensitivity in load calculation. The first adjudication threshold refers to the warning boundary value that triggers dynamic adjustment of the safety threshold, denoted as... The typical value is 1.5 times the standard deviation. When the load index exceeds this value, the system enters the warning zone and begins to gradually reduce the allowable output intensity. The second circuit breaker threshold refers to the dangerous boundary value that triggers an absolute hardware veto, denoted as... The typical value is 3.0 times the standard deviation. When the load index reaches or exceeds this value, the system determines it to be in an emergency dangerous state, immediately sets the safety threshold to zero, and initiates physical shutdown. The maximum safe output value refers to the highest allowable treatment intensity of the system when the load index is within the normal range, denoted as . This corresponds to the full-scale output capability of the equipment design. Linear reduction refers to the physiological safety threshold within the warning zone. The load index k has an inverse linear relationship with the load index k, meaning the larger the k value, the better. The smaller the value, the smoother the decreasing safety boundary.

[0035] Understandably, by introducing a load index calculation weighted by historical benchmark deviation, a paradigm shift from static safety thresholds to dynamic safety windows has been achieved. Traditional static thresholds, using fixed values ​​(such as an absolute upper limit of 180 beats / minute for heart rate), cannot adapt to individual differences and changes in physiological scenarios. Deviation calculation based on historical benchmarks anchors safety judgments to the user's own normal level, allowing safety boundaries to adaptively adjust according to individual physiological characteristics. The preset weighting mechanism, trained offline through machine learning, accurately quantifies the contribution of different physiological parameters to sudden risks. For example, abnormal blood pressure may be more dangerous than heart rate fluctuations, thus assigning it a higher weight. This differentiated approach makes the load index calculation more physiologically reasonable. The three-stage threshold judgment logic (normal-alert-dangerous) constructs a graded response system from lenient to strict: in Maintain maximum treatment intensity within the normal range to ensure efficacy is not affected; The warning range is linearly decayed to achieve a smooth trade-off between risk and return; The danger zone is forcibly reduced to zero, providing a final safety net. This nonlinear dynamic adjustment mechanism not only avoids treatment interruption caused by threshold mutations, but also gradually tightens the safety boundary during the accumulation of risks. It effectively solves the core defects of static thresholds in the background technology, which are either too conservative or too aggressive, and enables physiological safety constraints to accurately match the continuous changes in real-time physiological load.

[0036] Preferably, the hardware-level veto mechanism includes: When the physiological safety enforcement layer determines that execution needs to be blocked based on the comparison result of the load index, it directly outputs a control signal through the GPIO pin of the independent microcontroller of the physiological safety enforcement layer. The control signal is transmitted to the hardware enable terminal of the power amplifier in the physical execution unit, and the control signal is logically ANDed with the drive signal from the execution arbitration layer; The physiological safety enforcement layer unconditionally blocks the execution of the proposed control strategy by physically cutting off the power supply path of the power amplifier by pulling the control signal down to an invalid level.

[0037] It should be noted that GPIO pins refer to general purpose input / output ports, which are microcontroller hardware pins that can be configured by software to output mode. They are used to directly output high and low level digital signals. In this embodiment, they are configured in push-pull output mode to provide sufficient current driving capability. The control signal is a valued hardware enable signal. When this signal is high (logic 1, typically 3.3V), it indicates that the power amplifier is allowed to operate; when it is low (logic 0, typically 0V), it indicates that the output is forcibly cut off. This signal is generated independently by the physiological safety enforcement layer and does not depend on any upper-level software state. The physical execution unit refers to the terminal execution device including the power amplifier, stimulation electrodes, and energy conversion circuit. Its function is to convert electrical signals into physical stimulation energy that acts on physiological tissues. The power amplifier refers to the analog circuit that amplifies the weak control signal (milliwatt level) output from the execution arbitration layer to a power level (watt level) sufficient to drive the stimulation electrodes. It contains a hardware enable pin (ENABLE pin), the level of which directly controls the power supply switch of the power amplifier core circuit. The logical AND relation refers to the AND operation in Boolean algebra. In circuit implementation, it means that two input signals jointly determine the output: the power amplifier outputs a valid stimulus only when both the control signal and the drive signal are high; if either signal is low, the output is immediately zero. An invalid level refers to the low voltage state corresponding to logic 0, typically 0V to 0.8V (depending on the device's level standard). When the GPIO outputs this level, the power amplifier's enable pin is turned off. The power supply path refers to the current path from the device's power supply (such as a lithium battery) to the power amplifier's output stage. An electronic switch (such as a MOSFET) controlled by the ENABLE signal is connected in series along this path. When the switch is open, the power supply path is physically cut off, and current cannot reach the actuator.

[0038] Understandably, the physiological safety enforcement layer does not notify the upper layer to stop execution via software instructions, but directly controls the underlying power circuit through GPIO level signals. This design ensures that even if the arbitration layer software crashes, deadlocks, or has logical vulnerabilities, the hardware circuit can still independently cut off the output, achieving true fail-safety. The logic AND relation design allows the control and drive signals to be cascaded at the hardware level, equivalent to setting a physical AND gate at the power amplifier input. This circuit cascading method avoids the risk of privilege bypass that may exist at the software level, because no software can modify the truth table of the hardware AND gate. Pulling the level low to an invalid state is a purely circuit action, with a response time only the delay of the GPIO output buffer (usually on the nanosecond level), much faster than the software interrupt response. This nanosecond-level veto capability ensures that the energy output is cut off in the shortest possible time after a danger is detected. The physical disconnection of the power supply path means that the stimulation energy source is completely isolated, with no risk of any residual energy leakage. This physical isolation is a level of safety that software control cannot achieve. The independence of the hardware-level veto mechanism is reflected in the complete separation of its control link and data path: the data path can still be communicated and calculated by the remote policy mediation layer and the execution arbitration layer, but the final switch of the control path is independently controlled by the physiological safety enforcement layer. This separation architecture realizes the decoupling and parallel operation of intelligent decision-making and security assurance.

[0039] Preferably, the physiological safety enforcement layer periodically performs the acquisition of the physiological parameters and the calculation of the physiological safety threshold at a preset high-frequency sampling period; The total time taken by the physiological safety enforcement layer from collecting physiological parameters to triggering the hardware-level veto mechanism is shorter than the time required for the control strategy proposal generated by the remote policy mediation layer to be sent to the execution arbitration layer.

[0040] It should be noted that the high-frequency sampling period refers to the time interval between the physiological parameter acquisition and calculation performed by the physiological safety enforcement layer. This period is pre-configured as a fixed value in the system firmware, which can be set to 100 milliseconds. This period value must satisfy the Nyquist sampling theorem to ensure accurate capture of physiological mutation signals. Periodic execution refers to the microcontroller of the physiological safety enforcement layer automatically triggering the complete acquisition-calculation-determination process at the arrival of each sampling period using a timer interrupt-driven method. This execution mode does not depend on external events, forming a stable local closed loop. Total latency refers to the complete time chain from the start of the physiological sensor's analog-to-digital conversion, through data filtering, load index k calculation, threshold comparison, to the final GPIO pin level transition. This time chain includes hardware latency and software execution time, and is a core indicator for measuring safety response speed. Transmission latency refers to the time difference between the issuance of the control strategy proposal by the remote policy mediation layer and the complete reception by the execution arbitration layer. This time is determined by factors such as network bandwidth, routing hop count, and protocol overhead, and typically exceeds 200 milliseconds. Preset refers to parameter values ​​determined through theoretical analysis and experimental verification during the system architecture design phase. High frequency refers to a sampling rate that is fast enough relative to the frequency of physiological signal changes to ensure that the system response speed is much faster than the rate of evolution of physiological risks.

[0041] Understandably, by introducing explicit timing constraints, the response speed of the physiological safety enforcement layer is designed as a core performance indicator of the system. A preset high-frequency sampling period ensures that the physiological safety enforcement layer can continuously monitor physiological states, avoiding monitoring blind spots caused by discrete sampling in traditional schemes. The periodic execution mechanism makes safety computation a time-bound deterministic task, rather than a random event dependent on external triggers. The strict comparison between total latency and transmission latency forms the timing immunity basis of the multi-level arbitration mechanism: within the 200-millisecond time window of remote policy proposal transmission in the network, the physiological safety enforcement layer has completed at least two full sampling cycles, enabling it to complete danger identification and trigger hardware veto at the instant (millisecond level) of physiological mutation, ensuring that the physical path is cut off before the dangerous instruction reaches the executor. This timing design fundamentally solves the timing mismatch problem between cloud decision-making delay and physiological mutation speed in the background technology. Even if the remote server sends an extremely dangerous instruction due to algorithm defects or malicious attacks, the time when the instruction arrives at the local device will inevitably be later than the time when the local security mechanism has completed detection and blocking. The stringent timing constraints also drive the hardware optimization design of the physiological safety enforcement layer, including the selection of independent microcontrollers, DMA data transfer, and fixed-point number calculation, to ensure that the latency of the local response path is minimized. This top-down timing design approach transforms safety requirements into quantifiable engineering indicators, enabling the physiological safety enforcement layer to obtain absolute timing priority over remote commands.

[0042] Preferably, based on the analysis of user historical data and historical trends, the proposed regulatory strategies for optimizing the effects of physiological regulation include: The remote policy mediation layer is located on a cloud or edge server; The remote strategy adjustment layer uses a built-in artificial intelligence optimization model to perform big data analysis on the user's historical data and generate personalized treatment plans, including target intensity and duration, as the adjustment strategy proposal. The proposed control strategy is sent unidirectionally to the execution arbitration layer via the network transmission channel, and the remote strategy mediation layer is only granted suggestion authority and does not have any ability to directly control the physical execution unit.

[0043] It should be noted that "cloud" refers to computing clusters deployed in remote data centers, possessing massive storage and parallel computing capabilities, used to run complex AI models and store large-scale user data. "Edge server" refers to computing nodes deployed on the local network access side, located between the cloud and terminal devices, providing low-latency data processing and strategy generation services. "AI optimization model" refers to a predictive model built based on machine learning algorithms (such as Long Short-Term Memory networks (LSTM), random forests, or reinforcement learning). This model learns the temporal dependencies and personalized response patterns in users' historical data to output the optimal combination of treatment parameters. "Historical data" refers to time-series datasets generated during users' past treatments, including physiological parameter records, correlation data between stimulus intensity and physiological response, user activity logs, medication records, and environmental context information. The data span is typically no less than 30 days to ensure statistical significance. "Big data analysis" refers to the data processing workflow that performs feature engineering, pattern recognition, and causal inference on historical data, including data cleaning, missing value imputation, standardization, statistical feature extraction (mean, variance, frequency domain features), and time-series modeling. Target intensity refers to the stimulation output level suggested by the remote strategy mediation layer, quantified as a percentage or voltage value, reflecting the expected therapeutic effect. Duration refers to the duration of a single stimulation treatment, measured in seconds or minutes, used to control energy accumulation and tissue adaptation. Personalized treatment plan refers to a set of parameters customized for specific user physiological characteristics and response patterns, as opposed to a generalized fixed parameter plan. Network transmission channel refers to a communication link based on the TCP / IP protocol stack or MQTT message queue, which is encrypted with TLS and uses two-way authentication to ensure the confidentiality and integrity of data transmission. One-way transmission means that the data flow only goes from the remote strategy mediation layer to the execution arbitration layer, and only status feedback and audit logs are transmitted in the reverse direction. The remote layer cannot receive control commands from the local layer, preventing the formation of control loops. Suggestion authority means that the remote strategy mediation layer is defined as a suggester in the system permission model. The strategy proposals it generates are only for reference and do not have mandatory enforcement power. They must be verified locally to take effect. Direct control refers to the behavior of directly driving the physical execution unit by bypassing the local arbitration logic. In this embodiment, hardware isolation ensures that the remote layer cannot access the power amplifier drive circuit. A physical actuator is a terminal device that includes a power amplifier, stimulating electrodes, and energy conversion circuitry. Its function is to convert electrical signals into physical stimulation energy that acts on physiological tissues.

[0044] Understandably, the powerful computing capabilities of the cloud support the training and inference of complex AI models, enabling the discovery of deep nonlinear relationships within users' historical data and generating more accurate and forward-looking treatment recommendations than local static rules. Edge server deployment options offer a low-latency alternative suitable for scenarios with high real-time requirements, while reducing the pressure on centralized cloud processing. The introduction of AI-optimized models upgrades policy generation from rule-based expert systems to data-driven adaptive systems. These models continuously learn individualized physiological response patterns, such as identifying whether a specific user is more sensitive to stimuli in the morning or requires higher intensity after exercise, thus outputting dynamically adapted personalized parameters. Strictly limiting suggestion permissions is a core design element of the architecture's security. By clearly defining the remote role as a suggester rather than a controller, the risk of cloud permission abuse is fundamentally avoided. Even if a cloud account is hijacked or the AI ​​model malfunctions and generates extreme parameters, these parameters, once they reach the local machine, still undergo hardware-level arbitration under the physiological security enforcement layer and cannot directly affect the physical execution unit. The one-way transmission mechanism further strengthens this permission isolation. The inability of the remote to receive local control commands means that a closed-loop control that bypasses local security cannot be formed, ensuring that the local side always retains the final decision-making power. The above hierarchical permission design directly addresses the fatal flaw in the background technology where the cloud has super administrator privileges and can override local security settings. It achieves the inherent security of the distributed system through architectural permission trimming.

[0045] Preferably, step S3 includes: The physiological safety threshold output by the physiological safety enforcement layer is stored in a local read-only register or output through a separate hardware enable pin, and the execution arbitration layer reads it directly through a hardware-level interface.

[0046] It should be noted that a local read-only register refers to a memory unit configured as read-only within the microcontroller of the physiological safety enforcement layer via a hardware fuse bit or a special function register lock bit. This register address is mapped to the microcontroller's memory space, but write operations are permanently disabled by the hardware circuitry, and its contents cannot be modified by any software instruction (including a debugger). The hardware enable pin refers to the physical GPIO pin on the package of the physiological safety enforcement layer microcontroller. This pin is configured as an output, and its level state (high or low) directly reflects whether the current physiological safety threshold allows execution. The level signal does not undergo any bus protocol conversion and is directly connected to the input pin of the execution arbitration layer via PCB traces. The hardware-level interface refers to the low-level hardware access mechanism used by the execution arbitration layer when reading the physiological safety threshold, including memory-mapped I / O (MMIO) and direct pin level reading. These interfaces bypass the operating system driver layer and directly obtain physical signals through register operations or port read instructions, with read latency in the nanosecond range. Direct read refers to the microcontroller executing the arbitration layer accessing read-only registers or sampling pin levels by executing single-cycle assembly instructions (such as LDR or GPIO_IDR) without any intermediate software components (such as drivers, protocol stacks, or service processes). This ensures that the acquired data is the latest calculation result from the physiological safety enforcement layer and has not been tampered with. The dual mechanism of storage and output provides a redundant and reliable data source for the arbitration layer. The read-only register method provides precise numerical safety thresholds, while the hardware enable pin method provides physical rejection signals. Together, they constitute an unbypassable secure information channel.

[0047] Understandably, by designing the storage and output of physiological safety thresholds as a hardware-level read-only mechanism, a trusted data path is constructed from the physiological safety enforcement layer to the execution arbitration layer. The hardware locking characteristic of the read-only register ensures... Once the value is calculated and written by the physiological security enforcement layer, it cannot be modified by the remote policy mediation layer through any network commands, nor can it be overwritten by accidental writes by the execution arbitration layer software. This hardware-level anti-tampering capability fundamentally eliminates the risk that cloud permissions can overwrite local security settings, as is present in the background technology. An independent hardware enable pin provides a physical rejection signal. This signal does not rely on data bus communication; even if the bus is blocked due to a fault or attack, the level change of the physical pin can still transmit the security status, forming a redundant security information channel. The execution arbitration layer reads directly through the hardware-level interface, meaning that obtaining… The process bypasses the software abstraction layer, avoiding driver latency, scheduling latency, or man-in-the-middle attacks. The single-cycle nature of the read operation ensures that the execution arbitration layer obtains the latest (no more than 100ms) safety window value from the physiological safety enforcement layer at the decision-making moment, rather than expired data. This direct hardware connection read method compresses data acquisition latency from milliseconds to nanoseconds, creating an order-of-magnitude difference compared to the network transmission latency of remote commands (greater than 200ms), ensuring absolute temporal priority of safety information during arbitration decisions. The dual storage and output mechanism design gives the system heterogeneous redundancy characteristics. Read-only registers provide quantitative safety boundary values, while hardware pins provide qualitative rejection signals. The execution arbitration layer can use both simultaneously for cross-validation, further enhancing decision credibility.

[0048] Preferably, in step S5, the arbitration layer includes: The execution arbitration layer generates the execution drive signal only when the regulation strategy proposal conforms to the preset format and permissions, and its target intensity parameter is within the range limited by the physiological safety threshold. After generating and outputting the execution drive signal, the execution arbitration layer enters a continuous monitoring loop and continuously reads the status of the physiological safety enforcement layer at a frequency not less than the sampling period of the physiological safety enforcement layer. Once a hardware rejection signal or software stop flag is detected by the physiological safety enforcement layer during the continuous monitoring cycle, the execution arbitration layer immediately stops outputting the execution drive signal and forcibly jumps to the safety blocking state.

[0049] It should be noted that the preset format and permissions refer to the preliminary legality verification mechanism of the arbitration layer for the received control strategy proposals. This includes data packet integrity verification (such as CRC32 cyclic redundancy check), protocol version matching, digital signature verification, and role and permission checks to ensure that the proposal source is trustworthy and has not been tampered with. This verification is performed at the software level and takes approximately 1-2 milliseconds. The process of generating the exponentially quantized pulse control sequence of the execution drive signal is then performed, and the arbitration layer assigns the target strength parameter that has passed security verification. The signal is converted into specific hardware control instructions, outputting an analog voltage waveform via a digital-to-analog converter (DAC) or configuring pulse parameters via a digital interface. This signal directly drives the power amplifier circuit. The continuous monitoring loop refers to the background monitoring thread or timer interrupt service routine maintained by the execution arbitration layer during the output drive signal. This loop periodically reads the physiological safety enforcement layer status at a fixed frequency (no less than the 100-millisecond sampling period of the physiological safety enforcement layer), forming a dynamic safety verification mechanism during the execution phase. The hardware veto signal refers to the physical level signal (active low) output by the physiological safety enforcement layer through an independent GPIO pin. This signal does not pass through any software layer and directly reflects whether an emergency fuse has been triggered. The execution arbitration layer obtains this signal status within one clock cycle by reading the GPIO input data register. The software stop flag refers to a Boolean status variable written to the shared memory area by the physiological safety enforcement layer. This variable is set when the load index k exceeds a threshold. The execution arbitration layer reads this flag via memory-mapped I / O, with a read latency of approximately 20 nanoseconds. The safety blocking state refers to the emergency protection mode entered after the execution arbitration layer responds to the rejection signal or the stop flag. In this state, the execution arbitration layer immediately terminates the DAC output, clears the PWM buffer, and forcibly pulls the power amplifier enable terminal low to achieve zero output.

[0050] Understandably, by constructing a dual verification mechanism and a continuous monitoring loop at the execution arbitration layer, dynamic safety control is implemented in two time dimensions: before and during instruction execution. A driving signal is generated only when the proposed control strategy passes both format permission verification and threshold range comparison. This dual verification ensures that execution decisions are based on trusted sources and conform to current physiological safety boundaries, preventing proposals with incorrect formats or excessive permissions from entering the execution phase. The continuous monitoring loop operates at a frequency no less than the sampling cycle of the physiological safety enforcement layer, meaning that the system continuously synchronizes physiological state changes during stimulus output, avoiding the risk of loss of control due to physiological mutations during execution after one-time verification. This closed-loop monitoring mechanism upgrades static pre-verification to dynamic, full-process monitoring. The heterogeneous redundancy design of hardware veto signals and software stop flags provides dual-channel state awareness capabilities. Hardware signals provide rapid physical-level veto, while software flags provide numerical state information. The execution arbitration layer simultaneously monitors both, allowing for cross-verification. Even if one channel fails, the other can still trigger blocking, significantly improving monitoring reliability. Once a danger signal is detected, the system will immediately switch to a safe blocking state. This unconditional switching mechanism gives the continuous monitoring loop the highest interruption priority. Any normal execution process can be preempted by a safety event, ensuring the absolute real-time nature of physiological safety constraints.

[0051] Preferably, the physiological safety enforcement layer has built-in adjudication benchmark parameters, including preset weights for calculating the load index, historical benchmark mean and standard deviation of physiological parameters, the first adjudication threshold and the second circuit breaker threshold, all of which are permanently stored in the read-only memory of the physiological safety enforcement layer. The remote policy mediation layer has only read access to the read-only memory that stores the adjudication benchmark parameters, and cannot perform any remote write or modification operations on it.

[0052] It should be noted that the adjudication benchmark parameters refer to the entire set of static configuration data upon which the physiological safety enforcement layer relies for calculating load indicators and determining thresholds. Their accuracy directly determines the effectiveness of the physiological safety assessment. The preset weights refer to a set of normalized coefficients reflecting the contribution of each physiological parameter to the overall risk, obtained through offline machine learning algorithms. The weight values ​​are between 0 and 1, and their sum is 1. The training process uses historical risk events as labels, and optimizes the weight allocation through logistic regression or random forest to maximize the predictive sensitivity of the load indicators to real risks. The historical baseline mean and standard deviation refer to individualized physiological baseline statistics established through long-term monitoring of specific users. Characterizes the user's normal physiological level, standard deviation Characterizing the range of physiological fluctuations, both are automatically calculated using a moving average algorithm during the initial use period (e.g., 7 days) and updated periodically. First adjudication threshold. With the second circuit breaker threshold This refers to the boundary values ​​that divide physiological load into three zones: safe, alert, and dangerous. The warning trigger line is typically set at 1.5 times the standard deviation. This is an emergency fuse, typically set to 3.0 times the standard deviation. Read-only memory (ROM) refers to physical storage media configured with permanent read-only attributes through a hardware fuse bit locking mechanism. This includes specific sectors of the microcontroller's internal FLASH memory or one-time programmable (OTP) memory areas. Once locked, any write operation is blocked by the hardware circuitry and cannot be modified through software instructions or debugging interfaces. Read permission refers to the restricted access capability to the contents of ROM granted by the remote policy mediation layer in the system permission model, allowing it to read through a secure authentication channel. , These parameters are used for model training, but write or erase operations are explicitly prohibited. Remote write or modification operations refer to any attempt to change the contents of read-only memory transmitted over a network, including firmware updates, parameter configuration instructions, or debugging commands. These operations are completely blocked at the hardware level to ensure the integrity and immutability of the adjudication benchmark parameters.

[0053] Understandably, by embedding the adjudication benchmark parameters into the read-only memory (ROM) of the physiological safety enforcement layer and strictly limiting the remote policy mediation layer to read access only, a physical-level tamper-proof barrier for secure computation parameters is constructed. Preset weights and historical benchmark parameters are the core basis for personalized security judgments. If these parameters can be remotely modified, attackers could bypass the hardware veto mechanism by reducing the weight of dangerous parameters or tampering with the benchmark value to ensure the calculated load index k remains permanently below the threshold. Embedding these parameters into ROM ensures they are immutable after the device leaves the factory or is initialized; no remote commands, firmware updates, or debugging tools can modify their contents, fundamentally eliminating the possibility of cloud-based permission abuse or malicious attacks tampering with security parameters. The read access of the remote policy mediation layer allows it to obtain user historical baseline data for AI model training. This unidirectional data flow supports cloud-based intelligent optimization while avoiding the risk of reverse writes. The hardware-level write protection mechanism does not rely on software permission checks but is implemented based on the physical characteristics of transistors. Even if the microcontroller firmware is completely replaced, the ROM content remains unchanged. This unbypassability provides a trusted computational foundation for the physiological safety enforcement layer. The solidification of the adjudication benchmark parameters also ensures the consistency of safety judgments between different devices, avoids safety boundary drift caused by differences in software configuration, and makes the physiological safety enforcement layer an independent safety unit with deterministic behavior.

[0054] Preferably, step S1 further includes sensor fault safety handling logic: The physiological parameters were collected by a physiological parameter sensor; The physiological safety enforcement layer continuously monitors the signal quality of the connected physiological parameter sensors; When any physiological parameter sensor signal is lost or the signal-to-noise ratio is lower than the preset quality threshold, the preset fault safety strategy is automatically executed. The fail-safe strategy includes adjusting the preset weights of the corresponding physiological parameters to zero and recalculating the physiological safety threshold based on the preset minimum safety value or the remaining effective parameters.

[0055] It should be noted that physiological parameter sensors refer to physiological signal acquisition devices deployed on the user's body surface or implanted inside the body, including heart rate sensors (photoelectric or electrocardiogram electrode type), blood pressure sensors (piezoresistive or piezoelectric type), and respiration sensors (impedance or airflow type). These sensors are connected to the microcontroller of the physiological safety enforcement layer via hardwired connections, providing raw physiological data input. Signal quality refers to the reliability measure of the sensor output signal, including two dimensions: signal loss detection and signal-to-noise ratio (SNR) evaluation. Signal loss refers to sensor communication interruption or output of a constant abnormal value. SNR refers to the ratio of effective physiological signal power to background noise power, quantified in decibels (dB). The preset quality threshold refers to the lower limit of signal quality calibrated experimentally during system design. The SNR threshold is usually set to 10dB; below this value, the signal is considered unreliable. Failure-safe strategy refers to the protective response mechanism automatically triggered when a sensor failure is detected. The core objective is to avoid misjudging the physiological state when some sensors fail, ensuring that safe calculations are based on valid data. The preset weight adjustment of the corresponding physiological parameter to zero means that in the calculation of the load index k, the weight coefficient of the dimension corresponding to the failed sensor is adjusted. Forced to 0, eliminating the impact of invalid data on the overall evaluation. The minimum safety value refers to the conservative safety threshold used when all sensors fail; it is typically set to [value missing]. This triggers a complete shutdown. The remaining valid parameters refer to the set of sensors that can still function normally after the faulty sensor is removed. The system recalculates the k value based on these parameters to ensure that the evaluation results reflect the true physiological state.

[0056] It is understandable that by introducing sensor failure safety handling logic, the robustness of the physiological safety enforcement layer is extended from the ideal state to the abnormal state of partial sensor failure. As the system input source, the reliability of physiological parameter sensors directly affects the accuracy of safety judgments. In practical applications, poor contact, electrode oxidation, motion artifacts, or hardware aging can lead to signal loss or noise overload. Continuous monitoring of signal quality enables the physiological safety enforcement layer to perceive the health status of sensors in real time, rather than blindly trusting input data. This self-monitoring capability is an important component of system reliability. Adjusting the corresponding weight to zero upon detecting a fault essentially implements dynamic dimensionality reduction in multi-dimensional data fusion, avoiding distortion of the load index k calculation result due to a single sensor malfunction. For example, if the heart rate weight is retained when a heart rate sensor detaches, the k value will have a huge negative deviation due to the heart rate reading being 0, causing the system to misjudge a safe state. The safety threshold is recalculated based on the remaining valid parameters to ensure that safety constraints remain effective when some sensors fail. When all sensors fail, the minimum safety value is used. This degradation design ensures system safety even in the worst-case scenario, avoiding the risk of loss of control when there is no input. The automatic triggering mechanism of the fail-safe strategy requires no manual intervention or cloud commands; it is independently judged and executed by the physiological safety enforcement layer, conforming to the fail-safe principle that any fault leads to a safe state. This design addresses the problem of excessive reliance on sensor hardware reliability in the background technology, improving the fault tolerance and robustness of the distributed control system in real clinical environments.

[0057] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0058] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A distributed control method with a multi-level arbitration mechanism, characterized in that, The multi-level arbitration control method is applied to a multi-level arbitration control system including a physiological safety enforcement layer, a remote strategy mediation layer, and an enforcement arbitration layer. The multi-level arbitration control method includes the following steps: S1: The physiological safety enforcement layer collects the user's physiological parameters in real time and calculates the physiological safety threshold based on the physiological parameters; S2: The remote strategy mediation layer generates a regulation strategy proposal for optimizing the effect of physiological regulation based on the analysis of user historical data and historical trends, and sends the regulation strategy proposal to the execution arbitration layer; S3: The arbitration layer receives the proposed regulation strategy and obtains the physiological safety threshold currently output by the physiological safety enforcement layer; S4: The arbitration layer compares the target parameters in the proposed regulation strategy with the physiological safety threshold. S5: If the target parameter is within the physiological safety threshold range, the execution arbitration layer generates an execution drive signal to execute the regulation strategy proposal; If the target parameter exceeds the physiological safety threshold range, the physiological safety enforcement layer blocks or downgrades the execution of the regulation strategy proposal through a hardware-level veto mechanism. The hardware-level veto mechanism operates independently of the remote policy mediation layer and the execution arbitration layer, and has the highest priority.

2. The distributed control method with a multi-level arbitration mechanism according to claim 1, characterized in that, Step S1 includes: The physiological safety mandatory layer collects physiological parameters including heart rate and blood pressure; The load index, which reflects the user's overall physiological state, is calculated based on the physiological parameters. The calculation of the load index is based on the deviation of the physiological parameters from historical benchmarks and preset weights. Based on the comparison results between the load index and the preset first decision threshold and second circuit breaker threshold, the physiological safety threshold is determined: When the load index is lower than the first decision threshold, the physiological safety threshold is the preset maximum safe output value; When the load index is between the first decision threshold and the second circuit breaker threshold, the physiological safety threshold decreases as the load index increases; When the load index is not lower than the second circuit breaker threshold, the physiological safety threshold is set to zero.

3. The distributed control method with a multi-level arbitration mechanism according to claim 1, characterized in that, The hardware-level veto mechanism includes: When the physiological safety enforcement layer determines that execution needs to be blocked based on the comparison result of the load index, it directly outputs a control signal through the GPIO pin of the independent microcontroller of the physiological safety enforcement layer. The control signal is transmitted to the hardware enable terminal of the power amplifier in the physical execution unit, and the control signal is logically ANDed with the drive signal from the execution arbitration layer; The physiological safety enforcement layer unconditionally blocks the execution of the proposed control strategy by physically cutting off the power supply path of the power amplifier by pulling the control signal down to an invalid level.

4. The distributed control method with a multi-level arbitration mechanism according to claim 3, characterized in that, The physiological safety enforcement layer periodically performs the acquisition of the physiological parameters and the calculation of the physiological safety threshold at a preset high-frequency sampling period; The total time taken by the physiological safety enforcement layer from collecting physiological parameters to triggering the hardware-level veto mechanism is shorter than the time required for the control strategy proposal generated by the remote policy mediation layer to be sent to the execution arbitration layer.

5. The distributed control method with a multi-level arbitration mechanism according to claim 3, characterized in that, Based on the analysis of user historical data and trends, the proposed regulatory strategies for optimizing physiological regulation effects include: The remote policy mediation layer is located on a cloud or edge server; The remote strategy adjustment layer uses a built-in artificial intelligence optimization model to perform big data analysis on the user's historical data and generate personalized treatment plans, including target intensity and duration, as the adjustment strategy proposal. The proposed control strategy is sent unidirectionally to the execution arbitration layer via the network transmission channel, and the remote strategy mediation layer is only granted suggestion authority and does not have any ability to directly control the physical execution unit.

6. The distributed control method with a multi-level arbitration mechanism according to claim 1, characterized in that, Step S3 includes: The physiological safety threshold output by the physiological safety enforcement layer is stored in a local read-only register or output through a separate hardware enable pin, and the execution arbitration layer reads it directly through a hardware-level interface.

7. The distributed control method with a multi-level arbitration mechanism according to claim 1, characterized in that, In step S5, the arbitration layer includes: The execution arbitration layer generates the execution drive signal only when the regulation strategy proposal conforms to the preset format and permissions, and its target intensity parameter is within the range limited by the physiological safety threshold. After generating and outputting the execution drive signal, the execution arbitration layer enters a continuous monitoring loop and continuously reads the status of the physiological safety enforcement layer at a frequency not less than the sampling period of the physiological safety enforcement layer. Once a hardware rejection signal or software stop flag is detected by the physiological safety enforcement layer during the continuous monitoring cycle, the execution arbitration layer immediately stops outputting the execution drive signal and forcibly jumps to the safety blocking state.

8. The distributed control method with a multi-level arbitration mechanism according to claim 2, characterized in that, The physiological safety enforcement layer has built-in adjudication benchmark parameters, including preset weights for calculating the load index, historical benchmark mean and standard deviation of physiological parameters, the first adjudication threshold and the second circuit breaker threshold, all of which are permanently stored in the read-only memory of the physiological safety enforcement layer. The remote policy mediation layer has only read access to the read-only memory storing the adjudication benchmark parameters and cannot perform any remote write or modification operations on it.

9. The distributed control method with a multi-level arbitration mechanism according to claim 8, characterized in that, Step S1 also includes sensor fault safety handling logic: The physiological parameters were collected by a physiological parameter sensor; The physiological safety enforcement layer continuously monitors the signal quality of the connected physiological parameter sensors; When any physiological parameter sensor signal is lost or the signal-to-noise ratio is lower than the preset quality threshold, the preset fault safety strategy is automatically executed. The fail-safe strategy includes adjusting the preset weights of the corresponding physiological parameters to zero and recalculating the physiological safety threshold based on the preset minimum safety value or the remaining effective parameters.

Images