A multi-layer hardware-coupled dual-master full-off-line multi-lingual home-based elderly emergency monitoring terminal

Abstract

The application discloses a multilayer hardware-coupled dual-master full-off-line multilingual home-based elderly emergency monitoring terminal. A real-time clock chip is externally connected with an OTP one-time storage chip through an I2C bus, a physiological data acquisition cycle is solidified by hardware, shielding of a conventional voice alarm is realized by hardware, only short message pushing is reserved, a real-time clock timing signal is connected with each module through a resistance, an SOS button is directly connected with a communication module interrupt pin and an RC and a third comparator are used for hardware discrimination of short and long press timing, two microphones are combined into a unified sound source through band-pass filtering and are connected with a multi-channel access operation master control ADC, filtering and audio circuits are guaranteed by a communication power supply domain, a communication module dials a rescuer first and then serially polls family members by using two W25Q64 Flash chips, the two W25Q64 Flash chips share an SPI bus, a bus arbitration circuit is built by using peripheral 74HC logic gates to realize hardware read-write interlocking, a Bluetooth firmware layer intercepts diagnosis text, and an emergency firmware is embedded in the communication module to independently schedule, so that the terminal can realize self-rescue in a down state, hardware false alarm prevention and full-off-line monitoring.

Description

Technical Field

[0001] This application relates to the field of monitoring system technology, and more specifically, to a multi-layer hardware-coupled dual-master fully offline multilingual home-based elderly care emergency monitoring terminal. Background Technology

[0002] In home-based elderly care emergency monitoring scenarios, timely emergency calls, on-site evidence collection, and remote notifications are crucial technical requirements for monitoring equipment. Currently, various electronic devices for emergency alarms or health monitoring have emerged on the market, primarily falling into the following independent product categories: The first category is vehicle-mounted emergency alarms (such as eCall systems), typically installed in vehicles and triggering an instantaneous alarm only in the event of a collision. These devices employ a single-channel shared power supply architecture, with development focused on reducing vehicle power consumption and ensuring instantaneous trigger reliability. They completely neglect the needs of home-based elderly residents for standby, independent emergency call channels after main control failure, and dialect recognition, and also lack an isolated coupling circuit for direct communication to the emergency button. The second category is traditional single-MCU elderly care call devices, which use a single-chip, single-power supply architecture, supporting only a single-channel serial dialing logic. This means that any call connected by a family member terminates the entire call process. These devices lack dual-storage hardware interlocking, hardware-based timekeeping, and a dedicated path for forced switching to a unified emergency language during emergencies. If the main control chip program freezes or the screen goes black, the entire device's communication function is simultaneously paralyzed.

[0003] The third category is offline AI voice speakers, which physically isolate the audio and communication channels in their hardware. They are only used for everyday entertainment conversations and lack coupling logic such as health data collection and filtering, firmware interruption preemption, and forced priority of emergency audio. The fourth category is Bluetooth health bracelets, which independently collect physiological data. However, their accompanying algorithms often include disease diagnosis or risk assessment text. If simply spliced ​​with other calling devices, the entire device will fall under the scope of medical device regulation, leading to a sharp increase in the threshold for market access qualifications.

[0004] The aforementioned products have long belonged to different R&D tracks, leading industry engineers to develop a fixed design mindset that "a single MCU + common power supply can meet alarm requirements," generally believing that adding multiple isolated power supplies is redundant hardware. Therefore, there is no technical motivation in this field to integrate call, voice, and health monitoring modules into a single multi-layered hardware-coupled device, nor is there any technical inspiration from cross-track integration. If one attempts to assemble existing mature products such as voice speakers, pagers, and health bracelets using purchased modules with simple wiring to achieve multi-functional monitoring, irreconcilable conflicts will arise at the hardware level: First, power supply conflicts: when multiple independent devices share a single main control unit, a freeze in the main control program will cause the communication module to lose power synchronously, leaving no independent hardware emergency channel; second, scheduling conflicts: simultaneous operation of audio reception, health data collection, and telephone calls will compete for bus resources, resulting in frequent missed alarms and false alarms due to the lack of hardware noise filtering; third, audio conflicts: the lack of hardware interlocking switches between dialect and Mandarin audio channels makes it impossible to force a switch to a unified emergency language in case of a sudden illness; finally, compliance conflicts: the built-in diagnostic algorithm of the bracelet makes the assembled device fall under the regulation of Class II medical devices, and companies without the necessary qualifications cannot go public.

[0005] Furthermore, existing single-item or simple assembly solutions suffer from several interconnected technical defects: they generally rely on cloud servers for voice recognition and data processing, resulting in core functions failing after network outages and privacy risks due to the uploading of audio and physiological data; they only support Mandarin recognition, lacking offline dialect recognition and hardware forced switching mechanisms; they lack dual-layer hardware noise reduction verification, leading to frequent false alarms triggered by environmental noise such as television and traffic; the built-in diagnostic text on health devices creates a medical qualification barrier, and only supports single-time synchronization without local periodic summaries; they lack hardware latching and evidence collection links for ambient sound and call recording; and the lack of tiered low-power management causes the entire device to lose connection directly when the battery is depleted.

[0006] Therefore, it is evident that in the existing technology field, whether using a single product or simply piecing together purchased modules, it is impossible to simultaneously eliminate the underlying conflicts in power supply, scheduling, audio, and compliance, as well as the aforementioned cascading defects. There is a lack in this field of monitoring terminals that can achieve multi-module mutual constraint and binding, resource sharing, and fully local offline independent operation at the hardware level, in order to solve problems such as system downtime and loss of connection, missed notifications of emergencies, dialect communication barriers, and privacy leaks. Summary of the Invention

[0007] The purpose of this application is to overcome the existing technical defects and provide a multi-layer hardware-coupled dual-master fully offline multilingual home-based elderly care emergency monitoring terminal. By building a multi-layer hardware mutually constrained and bound dual-master fully offline coupled architecture and a dedicated hardware interlocking circuit, it solves the technical problems of existing monitoring equipment that cannot be synchronously eliminated by simple assembly, such as power supply failure, missed scheduling notifications, audio dialect barriers, and cloud privacy leaks.

[0008] The objective of this application is achieved through the following technical solution: In the first aspect, this application proposes a multi-layer hardware-coupled dual-master control fully offline multilingual home-based elderly care emergency monitoring terminal, including: a computing master control chip independently powered by a first power supply domain, a communication module independently powered by a second power supply domain, and a real-time clock chip independently powered by a third power supply domain. The negative power supply terminal of the main control chip and the negative power supply terminal of the communication module are connected to a single-point ground via a common cathode dual Schottky diode and an isolation ferrite bead; the timing signal output terminal of the real-time clock chip is connected to the main control chip, the communication module, the Bluetooth module and the audio acquisition circuit via resistors across the domain. The SOS button is directly connected to the interrupt pin of the communication module via a hardware circuit, and this hardware circuit does not pass through the I / O port of the main control chip. The SOS button is equipped with an RC charging and discharging circuit. The output of the RC charging and discharging circuit is connected to a third comparator. The output of the third comparator is connected to the interrupt pin of the communication module so that the communication module can distinguish between short press and long press signals. The two microphones are combined into a unified sound source by a bandpass filter circuit, and then the sound is transmitted to multiple analog-to-digital converter pins of the main control chip for acquisition. The bandpass filter circuit and the audio acquisition circuit are powered by the second power supply domain. The channel control terminal of the analog switch is connected to the hardware alarm level output of the logic AND gate. The negative bias voltage pin of the analog switch is provided with negative bias voltage by a negative charge pump. Under the action of the hardware alarm level, the analog switch physically cuts off the dialect audio path and conducts the Mandarin audio path. The negative charge pump is powered by the second power supply domain. The two input terminals of the AND gate are connected to the output terminals of the first comparator and the second comparator, respectively. The first comparator is connected to the human voice threshold level from the audio acquisition circuit, and the second comparator is connected to the noise baseline voltage calculated by the main control chip and output through the digital-to-analog conversion pin of the communication module. The first comparator, the second comparator, the third comparator, the AND gate, and the RC charging and discharging circuit are all powered by the second power supply domain. The communication module is connected to a first storage chip and a second storage chip. The first storage chip and the second storage chip are located in the second power supply domain and store the number of the person in distress and the number of their family members, respectively. The communication module is configured to first call back the person in distress using the number stored in the first storage chip, and then, based on the call status, serially poll the number of the family members in the second storage chip. Once any number is connected, the remaining numbers are not terminated. The Bluetooth module has a firmware layer data frame filtering unit, which is used to intercept diagnostic text frames and allow physiological values ​​to pass. The communication module includes an embedded processor and a memory storing emergency mode firmware. The emergency mode firmware is used to independently execute communication scheduling after receiving a trigger signal from the main control chip or a hardware interrupt signal from the SOS button. The main control chip is connected to the TF card to perform local AI calculations and output a trigger signal when an anomaly is detected. The terminal does not have a hardware data transmission path to upload audio data, vital sign data, or AI models to external cloud servers.

[0009] In one possible implementation, the main control chip is an ESP32-S3 chip, the communication module is an A7670 4G communication module, the real-time clock chip is a PCF8563 chip, the analog switch is a CD4053BE analog switch, the logic AND gate is a 74HC08 two-input AND gate, the first comparator, the second comparator, and the third comparator are all LM393 voltage comparators, the common cathode dual Schottky diode is a BAT54C, the isolation bead is a 0603 packaged 600Ω isolation bead, and the first memory chip and the second memory chip are both W25Q64 Flash chips.

[0010] In one possible implementation, the RC charging and discharging circuit consists of a 1MΩ resistor and a 3.3μF capacitor. The output of the RC charging and discharging circuit is connected to a third comparator, which is an LM393 voltage comparator. The output of the LM393 voltage comparator is connected to the interrupt pin of the communication module. The communication module distinguishes between short press and long press by reading the duration of the interrupt pin's voltage level. When the main control chip of the communication module crashes, it reads the number from the first storage chip and / or the second storage chip according to the emergency mode firmware and performs dialing.

[0011] In one possible implementation, the bandpass filter circuit is a second-order bandpass filter circuit with a high-pass cutoff frequency of 300Hz and a low-pass cutoff frequency of 3400Hz, and is powered by a second power supply domain. The unified audio source is connected to the three analog-to-digital converter pins of the main control chip for time-division multiplexing. The main control chip works with the TF card to store and calculate the ambient noise baseline. The calculated noise baseline value is transmitted to the communication module via SPI, and then output by the digital-to-analog converter pin of the communication module to the inverting input of the second comparator. The audio acquisition circuit is powered by the second power supply domain; when the main control chip crashes, the microphone and audio acquisition circuit can still acquire sound signals, and the iterative update of the noise baseline stops.

[0012] In one possible implementation, the common terminal of the analog switch is connected to the unified sound source output by the audio acquisition circuit, the first channel of the analog switch is connected to the dialect power amplifier, the second channel of the analog switch is connected to the Mandarin power amplifier, the control terminal of the analog switch is connected to the hardware alarm level output by the logic AND gate, the power supply terminal of the analog switch is connected to the power supply voltage, the ground terminal is grounded, and the negative bias voltage pin is connected to the negative bias voltage output by the negative voltage charge pump. When the output of the AND gate is high and connected to the control terminal of the analog switch, the analog switch physically cuts off the dialect audio path and connects the Mandarin audio path; when the main control chip crashes, the negative bias voltage output by the negative charge pump and the hardware alarm level output by the AND gate remain valid.

[0013] In one possible implementation, the RC charging and discharging circuit is used to determine whether the connection is disconnected within 3 seconds after being connected, and the emergency mode firmware pre-burned in the communication module's memory is configured as follows: Lock down the multi-level interrupt priority, with the SOS button interrupt and voice recognition interrupt having the highest priority; After the alarm is triggered, the communication module performs the following communication scheduling according to the emergency mode firmware: Controls the dialing of the distress caller's number stored in the first storage chip to call back the distress caller; Based on the call status feedback signal from the communication module and the level signal output by the RC charging and discharging circuit, the answering status is determined and the call is routed to one of the following four processing paths: Path 1: When the person calling for help answers the call, record the audio, hang up, poll the family member's number stored in the second storage chip, and send a text message simultaneously. Path 2: If no one answers, directly poll the family member's number stored in the second memory chip and simultaneously send an urgent text message; Path 3: When the caller is not the one calling for help, the system performs identity verification and simultaneously records the call audio and ambient sound. After hanging up, it polls for and dials the family member's number stored in the second storage chip and simultaneously sends a text message. Path 4: If the call is disconnected within 3 seconds of being connected, the system will directly poll and dial the family member's number stored in the second storage chip and send a text message simultaneously. Of the four processing paths mentioned above, polling is a serial polling method, where dialing of the remaining numbers is not terminated once any number is connected. Once the family member's number is connected, the communication module will automatically play the following sequence according to the emergency mode firmware: prompt message, 30 seconds of ambient sound, call recording, and closing remarks. When the main control chip crashes, the emergency mode firmware can still independently execute the above communication scheduling, but the identity verification and voiceprint comparison functions that rely on the main control chip's AI calculation in path one and path three are unavailable. The four processing paths are downgraded to two: someone answers and no one answers.

[0014] In one possible implementation, the terminal is configured with hardware timing circuitry for four-layer identity verification, which is performed in the following order: In the first layer, the communication module plays a voice prompt for the name based on the emergency mode firmware, and the first comparator detects whether the other party has a voice response in order to perform name voice matching. The second layer involves the main control chip performing voiceprint comparison on the other party's voice to determine whether it is the person calling for help. The third layer involves the main control chip performing keyword recognition on the other party's voice to determine whether it contains keywords for emergency help. The fourth layer uses an RC charging and discharging circuit for call timing. The RC charging and discharging circuit is reset to zero and starts timing the moment the call is connected. If there is no valid voice within 3 seconds, the comparator connected to the RC charging and discharging circuit outputs a level signal to the communication module, triggering the communication module to send an urgent text message and shorten the redial interval. When the main control chip crashes, the second and third layers become unavailable, and the fourth layer identity verification is downgraded to two layers, that is, only the name voice matching of the first layer and the RC call timing of the fourth layer are retained.

[0015] In one possible implementation, the terminal includes a recording latch circuit; After the alarm is triggered, the communication module synchronously controls the dual microphones to record 30 seconds of ambient sound according to the emergency mode firmware, and encrypts and records the call voice throughout the call. At the moment of disconnection, the communication module outputs a latch pulse according to the emergency mode firmware and locks the recording file in the evidence recording encryption partition of the TF memory card through the hardware write protection pin. The firmware of the communication module cannot overwrite or delete the latched recording file. Once the family member's number is connected, the communication module automatically plays 30 seconds of ambient sound and voice messages in a fixed sequence according to the emergency mode firmware.

[0016] In one possible implementation, the Bluetooth module includes a GATT layer data frame filtering circuit configured to block data frames containing diagnostic text transmitted by the wristband and only allow blood pressure and heart rate values. The real-time clock chip outputs multiple timing signals. Each timing signal is connected across the main control chip, communication module, Bluetooth module and audio acquisition circuit via a current-limiting resistor to trigger the acquisition of physiological values ​​in hardware. The terminal does not store the algorithm program used to generate disease diagnosis or risk assessment conclusions, and does not perform trend analysis calculations on physiological values ​​locally or in the cloud; it only stores the raw data of physiological values.

[0017] In one possible implementation, the TF card is divided into multiple logically encrypted partitions by the AES hardware accelerator built into the main control chip; the multiple logically encrypted partitions include at least a dialect lexicon partition, a noise baseline partition, a physiological recording partition, an evidence recording partition, and a system program partition; The first input of the AND gate is connected to the voice detection output of the first comparator, and the second input of the AND gate is connected to the noise detection output of the second comparator. The noise baseline voltage is calculated by the main control chip, transmitted to the communication module via SPI, and output to the inverting input of the second comparator by the digital-to-analog converter pin of the communication module. When the first comparator detects that the human voice threshold is met and the second comparator detects that the ambient noise is lower than the noise baseline voltage, the logic AND gate outputs a hardware alarm interrupt level.

[0018] The main solution and its various further alternatives described above can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed in this application; furthermore, the (non-conflicting alternatives) can also be freely combined with each other and with other alternatives. Those skilled in the art, after understanding the solution of this application, will realize from the prior art and common general knowledge that there are many combinations, all of which are technical solutions to be protected in this application, and will not be exhaustively listed here.

[0019] This application discloses a multi-layer hardware-coupled dual-master fully offline multilingual home-based elderly care emergency monitoring terminal. The computing, communication, and clock chips are independently powered by three physically isolated power supply domains. The negative terminals of the former two are grounded at a single point through a common cathode Schottky diode and an isolation ferrite bead. The real-time clock timing signal is connected to each module across domains via resistors. The SOS button is directly connected to the interrupt pin of the communication module and the short and long press timing is determined by RC and a third comparator. The dual microphones are combined into a unified audio source through bandpass filtering and multi-channel input to the computing master control ADC. The filtering and audio circuits are protected by the communication power supply domain. The analog switch is controlled by a logic AND gate to physically cut off dialects and conduct Mandarin. The AND gate is triggered by dual conditions by the first and second comparators. The communication module uses dual storage chips to first call back the person in distress and then serially poll the family members. The Bluetooth firmware layer intercepts diagnostic text. The communication module has an embedded emergency firmware for independent scheduling, which can realize self-rescue in case of failure, hardware prevention of false alarms, and fully offline monitoring. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This illustration shows a schematic diagram of a multi-layer hardware-coupled dual-master fully offline multilingual home-based elderly care emergency monitoring terminal proposed in an embodiment of this application.

[0022] Figure 2 A schematic diagram of the CD4053BE three-way double-pole double-throw analog switch proposed in an embodiment of this application is shown.

[0023] Figure 3 A schematic diagram of the two-layer hardware false alarm prevention system architecture proposed in an embodiment of this application is shown. Detailed Implementation

[0024] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0025] Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application.

[0026] Figure 1 The diagram shows a multi-layer hardware-coupled dual-master control fully offline multilingual home-based elderly care emergency monitoring terminal proposed in an embodiment of this application, including: a computing master control chip independently powered by a first power supply domain, a communication module independently powered by a second power supply domain, and a real-time clock chip independently powered by a third power supply domain. The negative power supply terminal of the main control chip and the negative power supply terminal of the communication module are connected to a single-point ground via a common cathode dual Schottky diode and an isolation ferrite bead; the timing signal output terminal of the real-time clock chip is connected to the main control chip, the communication module, the Bluetooth module and the audio acquisition circuit via resistors across the domain. The SOS button is directly connected to the interrupt pin of the communication module via a hardware circuit, and this hardware circuit does not pass through the I / O port of the main control chip. The SOS button is equipped with an RC charging and discharging circuit. The output of the RC charging and discharging circuit is connected to a third comparator. The output of the third comparator is connected to the interrupt pin of the communication module so that the communication module can distinguish between short press and long press signals. The two microphones are combined into a unified sound source by a bandpass filter circuit, and then the sound is transmitted to multiple analog-to-digital converter pins of the main control chip for acquisition. The bandpass filter circuit and the audio acquisition circuit are powered by the second power supply domain. The channel control terminal of the analog switch is connected to the hardware alarm level output of the logic AND gate. The negative bias voltage pin of the analog switch is provided with negative bias voltage by a negative charge pump. Under the action of the hardware alarm level, the analog switch physically cuts off the dialect audio path and conducts the Mandarin audio path. The negative charge pump is powered by the second power supply domain. The two input terminals of the AND gate are connected to the output terminals of the first comparator and the second comparator, respectively. The first comparator is connected to the human voice threshold level from the audio acquisition circuit, and the second comparator is connected to the noise baseline voltage calculated by the main control chip and output through the digital-to-analog conversion pin of the communication module. The first comparator, the second comparator, the third comparator, the AND gate, and the RC charging and discharging circuit are all powered by the second power supply domain. The communication module is connected to a first storage chip and a second storage chip. The first storage chip and the second storage chip are located in the second power supply domain and store the number of the person in distress and the number of their family members, respectively. The communication module is configured to first call back the person in distress using the number stored in the first storage chip, and then, based on the call status, serially poll the number of the family members in the second storage chip. Once any number is connected, the remaining numbers are not terminated. The Bluetooth module has a firmware layer data frame filtering unit, which is used to intercept diagnostic text frames and allow physiological values ​​to pass. The communication module includes an embedded processor and a memory storing emergency mode firmware. The emergency mode firmware is used to independently execute communication scheduling after receiving a trigger signal from the main control chip or a hardware interrupt signal from the SOS button. The main control chip is connected to the TF card to perform local AI calculations and output a trigger signal when an anomaly is detected. The terminal does not have a hardware data transmission path to upload audio data, vital sign data, or AI models to external cloud servers.

[0027] The main control chip is the ESP32-S3 chip, the communication module is the A7670 4G communication module, the real-time clock chip is the PCF8563 chip, the analog switch is the CD4053BE analog switch, the logic AND gate is the 74HC08 two-input AND gate, the first comparator, the second comparator and the third comparator are all LM393 voltage comparators, the common cathode dual Schottky diode is the BAT54C, the isolation bead is a 0603 packaged 600Ω isolation bead, and the first memory chip and the second memory chip are both W25Q64 Flash chips.

[0028] This application proposes a physical architecture for a multi-layered hardware-coupled dual-master-controlled, fully offline, multilingual home-based elderly care emergency monitoring terminal, which consists of three completely independent power supply domains. The main control chip uses an ESP32-S3 chip, independently powered by the first power supply domain (GND1), responsible for local AI computation. The communication module uses an A7670 4G communication module, which embeds an ARM processor and pre-burns emergency mode firmware, independently powered by the second power supply domain (GND2), responsible for voice calls and SMS sending / receiving. The real-time clock chip uses a PCF8563 chip, independently powered by the third power supply domain (GND3), responsible for timed wake-up and timing control. The PCF8563 is connected to an external OTP one-time storage chip via an I2C bus, hardware-fixed physiological data acquisition cycle, and hardware-blocks regular voice alarms from 23:00 to 7:00 the next day, only retaining SMS push notifications.

[0029] Regarding the isolation and interconnection across power supply domains, a 0603-packaged 600Ω isolation bead and a BAT54C common-cathode dual Schottky diode (unidirectional clamping) are connected in series between the negative power supply terminal (GND1) of the main control chip in the first power supply domain and the negative power supply terminal (GND2) of the communication module in the second power supply domain. Specifically, GND1 is connected to pin 1 (A1 anode) of the BAT54C via the bead, GND2 is connected to pin 3 (A2 anode) of the BAT54C, and the common cathode of pin 2 of the BAT54C is connected to the system's common ground (GND). This forms a single-point common ground connection, which blocks 4G RF interference and prevents voltage reverse flow. Simultaneously, the timing signal output of the real-time clock chip is connected across domains to the main control chip, communication module, Bluetooth module, and audio acquisition circuit via 1kΩ current-limiting isolation resistors to trigger coordinated action across these domains via hardware.

[0030] For the emergency call triggering link, the SOS button is directly connected to the interrupt pin of the communication module via a hardware circuit, and this hardware circuit does not pass through the I / O port of the main control chip, ensuring that the communication module can still be woken up when the main control chip fails. The SOS button is equipped with an RC charging and discharging circuit, consisting of a 1MΩ resistor and a 3.3μF capacitor. Its output is connected to a third comparator, and the output of the third comparator is connected to the interrupt pin of the communication module. The communication module reads the duration of the interrupt pin's voltage level through firmware, thus distinguishing between a short press of 0.5~2 seconds and a long press of ≥3 seconds. Each LM393 voltage comparator output is connected in series with a 10kΩ pull-up resistor to a 3.3V power supply.

[0031] For audio acquisition, the outputs of the dual MEMS microphones are combined into a single audio source via a bandpass filter circuit, and then distributed into three (or more) channels to the three analog-to-digital converter pins (ADC1_CH0, ADC1_CH1, ADC2_CH0) of the main control chip for time-division multiplexing. It is important to emphasize that both the bandpass filter circuit and the overall audio acquisition circuit are powered by the second power supply domain; therefore, even if the main control chip is powered off, the microphones can still acquire sound signals.

[0032] The language switching and alarm path control are as follows: The channel control terminal of the analog switch (CD4053BE) is connected to the hardware alarm level output of the logic AND gate (74HC08 two-input AND gate). Its negative bias voltage pin (VEE) is stably output at -1.5V by the ICL7660 negative charge pump (with a matching 104 filter capacitor) to the VEE pin of the CD4053BE, providing a negative bias voltage to eliminate switching pops. Under the action of the hardware alarm level (high level), the analog switch physically cuts off the dialect audio path (X0 channel) and conducts the Mandarin emergency power amplifier path (X1 channel), with the speaker power supply remaining uninterrupted and only the signal line disconnected. The negative charge pump is also powered by the second power supply domain.

[0033] The two inputs of the AND gate are connected to the outputs of the first and second comparators, respectively. The first comparator receives the human voice threshold level from the audio acquisition circuit after filtering by the TL082; the second comparator receives the noise baseline voltage calculated by the main control chip, transmitted to the communication module via SPI, and then output to the inverting input of the second comparator by the digital-to-analog converter pin of the communication module. The AND gate outputs a level 0 hardware alarm interrupt only when both inputs are high simultaneously. Furthermore, the first, second, and third comparators, the AND gate, and the RC charging and discharging circuit are all powered by the second power supply domain, ensuring that the pure hardware false alarm prevention and alarm switching remain effective even when the main control chip fails.

[0034] In the communication scheduling and storage architecture, the communication module is connected to a first storage chip and a second storage chip (two W25Q64 Flash chips). Both are located in the second power supply domain and have hardware write protection, storing the caller's own phone number and multiple family member numbers, respectively. The two W25Q64 chips share an SPI bus, and an external 74HC logic gate is used to build a bus arbitration circuit to achieve hardware read-write interlocking. The communication module is configured based on the embedded emergency mode firmware as follows: after an alarm is triggered, the caller is first called back using the number stored in the first storage chip. Then, based on the A7670 call status feedback signal and the RC circuit physical level signal, the family member numbers in the second storage chip are sequentially polled. Once any number is answered, the dialing queue of the remaining numbers is not terminated, ensuring no notification is missed.

[0035] In the Bluetooth health data acquisition branch, the Bluetooth module is equipped with a GATT firmware layer data frame filtering unit. This unit intercepts the text frames transmitted by the wristband at the firmware layer and only allows pure digital physiological values ​​such as blood pressure and heart rate to pass, thereby avoiding the risk of Class II medical device qualification.

[0036] The communication module includes an embedded processor and a memory storing emergency mode firmware. This emergency mode firmware is used to independently perform communication scheduling, including four-state traffic splitting, recording latching, four-segment playback, and polling scheduling, upon receiving a GPIO trigger signal from the main control chip or a hardware interrupt signal from the SOS button. In conjunction with this, the main control chip connects to a TF card to load a local multilingual pain recognition model for AI computation and outputs a trigger signal when an anomaly is detected. The entire terminal hardware lacks a transmission path for uploading audio data, vital sign data, or AI models to an external cloud server; the SIM card only enables point-to-point calls / SMS, thus forming a fully offline local monitoring system.

[0037] The RC charging and discharging circuit consists of a 1MΩ resistor and a 3.3μF capacitor. The output of the RC charging and discharging circuit is connected to a third comparator, which is an LM393 voltage comparator. The output of the LM393 voltage comparator is connected to the interrupt pin of the communication module. The communication module distinguishes between short press and long press by reading the duration of the interrupt pin's voltage level. When the main control chip of the communication module crashes, it reads the number from the first storage chip and / or the second storage chip according to the emergency mode firmware and performs dialing.

[0038] The RC charging / discharging circuit is specifically constructed using a 1MΩ resistor and a 3.3μF capacitor. The hardware charging / discharging time is stable at ≥3 seconds, unaffected by voltage fluctuations, and its accuracy in distinguishing between short and long presses is superior to smaller RC combinations. The output of this RC charging / discharging circuit is connected to a third comparator. In this design, an LM393 voltage comparator (dual-channel, open-collector output structure; in actual wiring, its output is equipped with a 10kΩ pull-up resistor to 3.3V, and this comparator and the RC circuit as a whole are powered by the second power supply domain to ensure independent operation across domains) is selected. The output of the LM393 voltage comparator is directly connected to the interrupt pin of the communication module (A7670). This interrupt pin is completely physically isolated from the I / O port of the ESP32-S3 main control chip, forming a hardware pass-through. When the user presses the SOS button, the RC circuit begins charging and discharging. The LM393 compares the capacitor voltage with a reference threshold and outputs a level signal. The ARM processor embedded in the communication module runs emergency mode firmware, which accurately distinguishes between a short press signal of 0.5~2 seconds (which only triggers a local prompt tone) and a long press signal of ≥3 seconds (which triggers the highest level hardware alarm interrupt) by reading the duration of the high level on the interrupt pin. Since the duration threshold is locked by the hardware parameters of the resistor and capacitor, the timing standard cannot be tampered with by the program. Compared with software timing schemes, the timing standard locked by the hardware RC parameters is not affected by program tampering.

[0039] The dual-channel hardware circuitry for the SOS button bypasses the ESP32-S3's I / O ports. The third comparator, RC circuit, and two W25Q64 Flash chips are all connected to the second power supply domain. The two W25Q64 chips share an SPI bus, and a hardware bus arbitration circuit with 74HC logic gates is used to implement read-write interlocking, storing the caller's number and family member's number respectively. Therefore, when the ESP32-S3 main control chip crashes due to program errors or complete power loss, the entire device loses its AI computing capabilities (local dialect recognition, voiceprint comparison, etc., are disabled). However, after manually pressing the SOS button, the interrupt signal can still reach the A7670 interrupt pin directly through the pure hardware circuitry. The LM393 outputs a long-press level based on the RC parameters. At this time, the communication module, based on the pre-programmed emergency mode firmware, directly reads the caller's local number from the first storage chip to perform a callback, and serially polls the family member's number from the second storage chip based on the call status feedback to perform a dial-up call. The entire process requires no intervention from the main control chip.

[0040] The bandpass filter circuit is a second-order bandpass filter circuit with a high-pass cutoff frequency of 300Hz and a low-pass cutoff frequency of 3400Hz, and is powered by the second power supply domain. The unified audio source is connected to the three analog-to-digital converter pins of the main control chip for time-division multiplexing. The main control chip works with the TF card to store and calculate the ambient noise baseline. The calculated noise baseline value is transmitted to the communication module via SPI, and then output by the digital-to-analog converter pin of the communication module to the inverting input of the second comparator. The audio acquisition circuit is powered by the second power supply domain; when the main control chip crashes, the microphone and audio acquisition circuit can still acquire sound signals, and the iterative update of the noise baseline stops.

[0041] The bandpass filter circuit uses a dual-channel JFET operational amplifier (TL082) to build a second-order bandpass filter circuit, with its high-pass cutoff frequency set at 300Hz and low-pass cutoff frequency at 3400Hz. The outputs of the two MEMS microphones are respectively connected to the two in-phase inputs of the TL082. After the aforementioned hardware bandpass filtering, the outputs of the two operational amplifiers are hardware shorted together to form a unified single audio source. This bandpass filter circuit and the overall audio acquisition circuit are explicitly powered by the second power supply domain, rather than by the first power supply domain of the main control chip itself. The unified audio source is connected to the three analog-to-digital conversion pins of the main control chip (ESP32-S3) via three independent lines for time-division multiplexing acquisition. Comparison of multi-channel homogeneous data can quickly calibrate the 72-hour hardware noise threshold.

[0042] Regarding the local calculation and cross-domain transmission of the environmental noise baseline, in this embodiment, the ESP32-S3 main control chip is connected to a TF card (multi-logic encrypted partition). The two work together to store and run a 72-hour noise baseline sliding window algorithm. The main control chip samples the environmental decibel level every 10 minutes, and the calculated noise baseline value is transmitted to the communication module (A7670) via the SPI bus. The digital-to-analog converter (DAC) pin inside the communication module converts the digital baseline value into an analog voltage, which is output to the inverting input of the second comparator as a reference threshold for hardware false alarm prevention. When the environmental decibel level fluctuates by less than 5dB for an extended period, the main control chip software locks the baseline threshold and stops iterative updates, equivalent to a hardware-fixed threshold effect.

[0043] The audio acquisition circuit (including the MEMS microphone, TL082 op-amp, and unified audio source merging network) is powered by the second power supply domain. Therefore, when the main control chip ESP32-S3 is completely powered off and crashes, the microphone and audio acquisition circuit can still independently acquire sound signals (physical layer sound pickup is unaffected). However, since baseline calculation and keyword recognition rely on the ESP32 software layer, when the main control chip crashes, the iterative update of the noise baseline immediately stops. The communication module firmware can only use the baseline value last transmitted via SPI and output by the DAC before the crash to continue providing a comparator reference.

[0044] The common terminal of the analog switch is connected to the unified sound source output by the audio acquisition circuit. The first channel of the analog switch is connected to the dialect power amplifier, the second channel of the analog switch is connected to the Mandarin power amplifier, the control terminal of the analog switch is connected to the hardware alarm level output by the logic AND gate, the power supply terminal of the analog switch is connected to the power supply voltage, the ground terminal is grounded, and the negative bias voltage pin is connected to the negative bias voltage output by the negative voltage charge pump. When the output of the AND gate is high and connected to the control terminal of the analog switch, the analog switch physically cuts off the dialect audio path and connects the Mandarin audio path; when the main control chip crashes, the negative bias voltage output by the negative charge pump and the hardware alarm level output by the AND gate remain valid.

[0045] Figure 2 A schematic diagram of the CD4053BE three-way double-pole double-throw analog switch proposed in this application embodiment is shown. The analog switch is the CD4053BE three-way double-pole double-throw analog switch. Its pin hardware is as follows: The common terminal of the analog switch (pin 13 COM) is connected to the unified audio source output by the audio acquisition circuit (i.e., the single-channel same-source audio after the TL082 dual-channel op-amp is combined); the first channel of the analog switch (pin 12 X0) is connected to the dialect power amplifier input; the second channel of the analog switch (pin 14 X1) is connected to the Mandarin emergency power amplifier input; the control terminal of the analog switch (pin 10 S0) is directly connected to the level 0 hardware alarm level output by the logic AND gate (74HC08N two-input AND gate). The source of this control signal is a pure hardware comparator AND gate circuit, without passing through the I / O port of the main control chip ESP32-S3; the power supply terminal of the analog switch (pin 16 VDD) is connected to the 3.3V digital power supply voltage, the ground terminal (pin 8 VSS) is connected to the digital GND, and the disable pin (pin 6 INH) is hardware grounded to keep the chip always on; the negative bias voltage pin of the analog switch (pin 7 VEE) is connected to the negative bias voltage output by the negative voltage charge pump. This negative bias is specifically used to eliminate the popping sound at the moment of audio channel switching.

[0046] Based on the above pin connections, the language switching logic in this embodiment is physically locked by hardware level: Under normal conditions without alarms, the AND gate outputs a low level (0V) to the control terminal S0, and CD4053BE turns on the first channel (X0), allowing the dialect audio channel to play normally; when the AND gate (74HC08) outputs a high level (3.3V) to the control terminal of the analog switch, the analog switch physically cuts off the dialect audio channel (X0 is off) and simultaneously turns on the Mandarin audio channel (X1 is on).

[0047] The CD4053BE analog switch, the ICL7660 negative charge pump, the aforementioned 74HC08 AND gate, and the LM393 comparator are all powered by the second power supply domain. Therefore, when the main control chip ESP32-S3 is completely powered off and crashes, as long as the alarm process has been triggered by a pure hardware comparator AND gate or by a hardware pass-through of the SOS button to trigger a firmware alarm, the negative bias voltage output by the negative charge pump and the high level of the hardware alarm output by the AND gate remain effective. The channel state of the analog switch is permanently locked by the hardware level, the dialect audio line remains physically disconnected, and the whole machine will only output standard Mandarin without any sound distortion or popping.

[0048] The RC charging and discharging circuit is used to determine whether the connection is disconnected within 3 seconds after being connected. The emergency mode firmware pre-burned into the communication module's memory is configured as follows: Lock down the multi-level interrupt priority, with the SOS button interrupt and voice recognition interrupt having the highest priority; After the alarm is triggered, the communication module performs the following communication scheduling according to the emergency mode firmware: Controls the dialing of the distress caller's number stored in the first storage chip to call back the distress caller; Based on the call status feedback signal from the communication module and the level signal output by the RC charging and discharging circuit, the answering status is determined and the call is routed to one of the following four processing paths: Path 1: When the person calling for help answers the call, record the audio, hang up, poll the family member's number stored in the second storage chip, and send a text message simultaneously. Path 2: If no one answers, directly poll the family member's number stored in the second memory chip and simultaneously send an urgent text message; Path 3: When the caller is not the one calling for help, the system performs identity verification and simultaneously records the call audio and ambient sound. After hanging up, it polls for and dials the family member's number stored in the second storage chip and simultaneously sends a text message. Path 4: If the call is disconnected within 3 seconds of being connected, the system will directly poll and dial the family member's number stored in the second storage chip and send a text message simultaneously. Of the four processing paths mentioned above, polling is a serial polling method, where dialing of the remaining numbers is not terminated once any number is connected. Once the family member's number is connected, the communication module will automatically play the following sequence according to the emergency mode firmware: prompt message, 30 seconds of ambient sound, call recording, and closing remarks. When the main control chip crashes, the emergency mode firmware can still independently execute the above communication scheduling, but the identity verification and voiceprint comparison functions that rely on the main control chip's AI calculation in path one and path three are unavailable. The four processing paths are downgraded to two: someone answers and no one answers.

[0049] In addition to determining the timing of SOS short / long calls, the RC charging and discharging circuit is also specifically used to detect abnormal scenarios where calls are disconnected within 3 seconds of being connected. The A7670 4G communication module's memory contains pre-burned emergency mode firmware, which is developed based on the SIMCom official OpenCPU SDK and runs on an embedded ARM processor. The firmware is configured to lock multiple interrupt priorities (levels 0-5), with the SOS button hardware interrupt and the dialect-based speech recognition interrupt identified by the main control chip set to the highest priority (level 0). Hardware arbitration gates are added for alarms at the same level, and the software program has no right to modify this priority configuration.

[0050] After the alarm is triggered, the communication module, according to the emergency mode firmware, first controls the dialing of the caller's mobile phone number stored in the first storage chip to call back the caller; then, the firmware determines the answering status and distributes it to the following four processing paths based on the call status signal fed back to the 4G network by the communication module itself and the level signal output by the aforementioned RC charging and discharging circuit (the capacitor is cleared to zero and the timer starts when the call is connected; if there is no valid voice within 3 seconds, the capacitor has not been charged to the threshold voltage and the LM393 outputs a low level): Path 1 (the person in distress answers): After the ESP32 software performs voiceprint comparison to confirm the identity, the A7670 firmware records the call voice. The moment the call is disconnected, the firmware outputs a latch pulse and performs hardware write protection recording. Then, it polls and dials the family number in the second storage chip (Flash2 family number) and sends a text message at the same time. Path 2 (No answer): The A7670 returns a no answer status feedback, and the firmware directly enters the emergency alarm process, directly polling and dialing the family member's number in the second storage chip and simultaneously sending an urgent text message; Path 3 (Non-caller answers, i.e., neighbor / passerby answers): The firmware works with the ESP32 to perform four layers of identity verification (name voice matching + voiceprint comparison + outsider keyword recognition + RC timing), simultaneously record the call audio and 30 seconds of ambient sound, and after hanging up, poll and dial the family member's number and send a text message simultaneously. Path 4 (Hang up within 3 seconds of connection): The RC circuit physical characteristics determine that the call will be disconnected if it lasts less than 3 seconds. The LM393 outputs a low level to the firmware, and the firmware triggers all alarms as usual, directly polling and dialing the family number and sending a text message at the same time.

[0051] Of the four processing paths mentioned above, since the entire device has only a single A7670 chip and only one physical RF channel, polling dialing is clearly a fast serial polling method. Once any number is connected, the dialing queue of the remaining numbers is not terminated, ensuring that no emergency is missed.

[0052] Furthermore, after the family member's number is connected, the communication module automatically plays the following fixed sequence according to the emergency mode firmware: Step 1 plays the prompt "Please listen to 30 seconds of on-site sound"; Step 2 plays 30 seconds of on-site ambient sound; Step 3 plays the call recording (if available, play; otherwise, skip); Step 4 plays the closing message "There is a situation with the elderly at home; please send someone to the scene as soon as possible." This playback sequence is fixed in the emergency mode firmware and cannot be modified, and is completely aligned with the recording latch branch of coupling circuit 6.

[0053] When the ESP32-S3 completely loses power and crashes, the emergency mode firmware can still independently execute the above communication scheduling. However, the identity verification and keyword recognition functions that rely on the AI ​​calculation of the main control chip in Path 1 and Path 3 are unavailable, and the four-layer identity verification is downgraded to two layers (only name voice matching + RC physical timing). Therefore, the four processing paths are downgraded to two: combining the answering by the person themselves and the answering by someone else into someone answering, and merging the no answering and the 3-second hang-up into no answering / second hang-up.

[0054] The terminal is equipped with hardware timing circuitry for four-layer identity verification, which is performed in the following order: In the first layer, the communication module plays a voice prompt for the name based on the emergency mode firmware, and the first comparator detects whether the other party has a voice response in order to perform name voice matching. The second layer involves the main control chip performing voiceprint comparison on the other party's voice to determine whether it is the person calling for help. The third layer involves the main control chip performing keyword recognition on the other party's voice to determine whether it contains keywords for emergency help. The fourth layer uses an RC charging and discharging circuit for call timing. The RC charging and discharging circuit is reset to zero and starts timing the moment the call is connected. If there is no valid voice within 3 seconds, the comparator connected to the RC charging and discharging circuit outputs a level signal to the communication module, triggering the communication module to send an urgent text message and shorten the redial interval. When the main control chip crashes, the second and third layers become unavailable, and the fourth layer identity verification is downgraded to two layers, that is, only the name voice matching of the first layer and the RC call timing of the fourth layer are retained.

[0055] The terminal is equipped with hardware timing circuitry for four-layer identity verification. This timing is fixed in execution order by emergency mode firmware embedded in the communication module, and works in coordination with the pure physical circuit layer. The four-layer identity verification is strictly performed in the following order: In the first layer, the communication module plays a voice prompt for the name based on the emergency mode firmware, and uses the first comparator to detect whether the other party has a voice response (the output level is high if the audio amplitude exceeds the human voice threshold level) to perform name voice matching.

[0056] The second layer involves the main control chip performing voiceprint comparison on the other party's voice, calling local AI to determine whether it is the person in distress, and the comparison result is fed back to the communication module via GPIO signal (this step is skipped if the ESP32 crashes).

[0057] The third layer involves the main control chip (ESP32-S3) performing keyword recognition on the other party's voice to determine whether it contains emergency help keywords such as "help," "first aid," and "help me" (this also relies on its AI computing and is skipped when the system crashes).

[0058] The fourth layer uses an RC charging and discharging circuit for call timing. The RC charging and discharging circuit is reset to zero and starts timing the moment the call is connected. If there is no valid voice within 3 seconds, the comparator connected to the RC charging and discharging circuit outputs a level signal to the communication module, triggering the communication module to send an urgent text message and shorten the redial interval. Neither the comparator nor the RC circuit is powered by the main control chip, so the physical timing is not affected by its failure.

[0059] In the aforementioned four-layer timing sequence, the first layer relies on the A7670 firmware and a pure hardware comparator, while the fourth layer relies on a pure physical RC circuit and a comparator, both of which are connected to the second power supply domain. The second layer voiceprint matching and the third layer keyword recognition must utilize the AI ​​computing capabilities of the ESP32-S3. Therefore, when the main control chip ESP32-S3 completely loses power and crashes, the second and third layers become unavailable, and the fourth layer identity verification is downgraded to two layers: only the first layer's name voice matching (firmware prompts + LM393 detection of response) and the fourth layer's RC call timing (physical circuit independently outputs an expedited signal) are retained.

[0060] The terminal includes a recording latch circuit; After the alarm is triggered, the communication module synchronously controls the dual microphones to record 30 seconds of ambient sound according to the emergency mode firmware, and encrypts and records the call voice throughout the call. At the moment of disconnection, the communication module outputs a latch pulse according to the emergency mode firmware and locks the recording file in the evidence recording encryption partition of the TF memory card through the hardware write protection pin. The firmware of the communication module cannot overwrite or delete the latched recording file. Once the family member's number is connected, the communication module automatically plays 30 seconds of ambient sound and voice messages in a fixed sequence according to the emergency mode firmware.

[0061] The terminal includes a recording latch circuit. The main functional components of this circuit are the emergency mode firmware embedded in the communication module and the corresponding TF memory card hardware write protection pin. Upon alarm triggering, the communication module, based on the emergency mode firmware, synchronously controls the dual microphones to immediately begin recording 30 seconds of ambient sound, without delay due to the dialing process. Simultaneously, the entire call is encrypted and recorded using the A7670 firmware. This recording circuit is powered by the independent power supply domain of the A7670 4G communication module. Therefore, even if the main control chip ESP32-S3 fails, the A7670 firmware can still control the TF card to complete the recording for evidence collection. The only limitation is the lack of ESP32 AI computation, which prevents automatic triggering of keyword alarms (requiring manual triggering via SOS). However, once triggered, the recording function is fully functional.

[0062] Regarding the hardware latching mechanism for audio recordings, this embodiment clarifies that: at the moment the call is disconnected, the communication module outputs a latching pulse according to the emergency mode firmware and locks the audio recording in the forensic recording encryption partition of the TF memory card via a hardware write-protection pin. This locking action takes effect at the physical level; the communication module's firmware itself cannot overwrite or delete the latched audio recording. Any subsequent operations are rejected by the hardware level, thus forming an immutable chain of evidence.

[0063] Furthermore, after the family member's number is connected, the communication module automatically plays the recorded content in a fixed order according to the emergency mode firmware. The fixed order is as follows: first, a prompt message is played, such as "Please listen to 30 seconds of the scene's sound," then 30 seconds of ambient sound is played, then if there is a call recording, it is played (if not, it is skipped), and finally, a closing message is played.

[0064] The Bluetooth module includes a GATT layer data frame filtering circuit, which is configured to block data frames containing diagnostic text transmitted by the wristband and only allow blood pressure and heart rate values. The real-time clock chip outputs multiple timing signals. Each timing signal is connected across the main control chip, communication module, Bluetooth module and audio acquisition circuit via a current-limiting resistor to trigger the acquisition of physiological values ​​in hardware. The terminal does not store the algorithm program used to generate disease diagnosis or risk assessment conclusions, and does not perform trend analysis calculations on physiological values ​​locally or in the cloud; it only stores the raw data of physiological values.

[0065] The Bluetooth module uses BLE-enabled chips such as the ESP32-C3 or nRF52832, which includes a GATT layer data frame filtering circuit. This filtering circuit is configured at the Bluetooth firmware protocol layer to intercept diagnostic text data frames containing keywords such as "diagnosis" or "disease" transmitted by the wristband, allowing only pure numerical physiological frames such as blood pressure and heart rate values. Data is blocked by the BLE firmware hardware gate before entering the main control chip, the ESP32-S3. This interception remains effective even if the main control chip crashes or the program malfunctions, and is not a simple post-installation software remedy found in general-purpose modules.

[0066] The real-time clock chip outputs multiple timing signals, each of which is connected across the main control chip, communication module, Bluetooth module, and audio acquisition circuit via a 1kΩ current-limiting isolation resistor. The purpose of this current-limiting resistor is to prevent backflow from voltage differences across power supply domains, which could burn out the chip. This allows for purely hardware-based timing triggering of physiological data acquisition, such as hardware-defined weekly acquisition and monthly summary timings. Furthermore, from 23:00 to 7:00 the next day, the hardware level blocks voice calls, allowing only SMS notifications.

[0067] The TF card is divided into multiple logically encrypted partitions by the AES hardware accelerator built into the main control chip; the multiple logically encrypted partitions include at least a dialect lexicon partition, a noise baseline partition, a physiological recording partition, an evidence recording partition, and a system program partition; in another parallel implementation, the partition hardware encryption of the TF card is completed by an independent encryption chip ATECC608A, forming two optional encryption implementation methods with the AES hardware accelerator built into the main control chip, and the applicant reserves the right to independent protection for the two encryption schemes.

[0068] The first input of the AND gate is connected to the voice detection output of the first comparator, and the second input of the AND gate is connected to the noise detection output of the second comparator. The noise baseline voltage is calculated by the main control chip, transmitted to the communication module via SPI, and output to the inverting input of the second comparator by the digital-to-analog converter pin of the communication module. When the first comparator detects that the human voice threshold is met and the second comparator detects that the ambient noise is lower than the noise baseline voltage, the logic AND gate outputs a hardware alarm interrupt level.

[0069] The TF card is divided into multiple logically encrypted partitions by the main control chip through a built-in AES hardware accelerator. The TF card itself does not support hardware-level physical partitioning; partitioning is a logical implementation at the main control level. Encryption is handled by the ESP32-S3's built-in AES hardware acceleration unit, unlike purely software-based folder encryption schemes. These multiple logically encrypted partitions include at least: a dialect dictionary partition (storing local multilingual pain recognition models), a noise baseline partition (storing 72-hour sliding window calculation data), a physiological recording partition (storing pure digital values ​​filtered by Bluetooth), an evidence recording partition (storing recording files latched by firmware), and a system program partition (storing underlying firmware). Cross-partition data access requires hardware-level key verification to prevent privacy data leakage.

[0070] The first input (pin 1) of the AND gate is connected to the voice detection output of the first comparator. The output level is derived from the TL082 unified audio amplitude comparison; a high level is output when a valid human voice is detected. The second input (pin 2) of the AND gate is connected to the noise detection output of the second comparator. The noise baseline voltage is calculated by the ESP32-S3 arithmetic control chip using a TF card. This baseline value is transmitted to the communication module via SPI and output from the communication module's digital-to-analog converter (DAC) pin to the inverting input of the second comparator as a hardware comparison reference. The first comparator, the second comparator, and the AND gate are all powered by the second power supply domain, ensuring that the pure hardware false alarm prevention layer operates continuously without relying on the arithmetic control chip.

[0071] Based on the above connection, the dual-condition triggering logic of this embodiment is as follows: the AND gate outputs a level 0 hardware alarm interrupt level only when the first comparator detects that the human voice threshold meets the standard (pin 1 high level) and the second comparator detects that the ambient noise is lower than the noise baseline voltage (pin 2 high level).

[0072] Figure 3 The diagram illustrates the dual-layer hardware false alarm prevention system architecture proposed in this application. The upper-layer main control chip (ESP32-S3) interacts with the communication module via the SPI bus. The digital-to-analog converter (DAC) pin of the communication module outputs the dynamically calculated noise baseline voltage to the lower-layer independent second power supply domain. This power supply domain serves as a pure hardware false alarm prevention layer. It has a first comparator that receives a unified audio signal for human voice detection and a second comparator that receives an ambient noise signal for baseline comparison. The detection results of each comparator are input into a logic AND gate for dual-condition verification. Finally, only when a valid human voice is detected and the ambient noise is lower than the baseline threshold is a level 0 hardware alarm interrupt level outputted. This ensures zero false alarms and hardware-level forced triggering even when the main control chip fails.

[0073] The beneficial effects of this application are as follows: First, existing single-power-supply, single-master-controller monitoring equipment experiences simultaneous 4G communication failure after the master controller crashes, lacking an independent distress call channel. This application addresses this with three-layer isolated power supply and SOS hardware pass-through, ensuring that even if the ESP32 fails, the A7670 firmware can still independently dial and poll, only downgrading to two answering paths without losing basic distress call capabilities.

[0074] Secondly, existing technology relies on software to determine human voices and noise based on single conditions, and the false alarm prevention logic disappears after the main control is powered off. The dual-microphone unified audio source is filtered by TL082 and then verified by two LM393 and 74HC08 hardware AND gates under dual conditions. The pure hardware layer continues to filter out false triggers of TV traffic even when the ESP32 crashes, reducing the false alarm rate.

[0075] Third, ordinary products rely on software to lower the dialect volume to achieve "soft muting," but when the main control malfunctions, the dialect is still played out normally, causing communication barriers in emergency situations. In this application, the CD4053BE physically cuts off the dialect audio signal line when the hardware alarm level is triggered, while the speaker power supply is retained, only the path is interrupted. Even after the ESP32 crashes, the negative bias and control level still effectively lock the Mandarin output.

[0076] Fourth, traditional pagers use a single-channel serial dialing system, where any family member answering terminates the entire call, and the system cannot distinguish between answering and receiving calls. This application's A7670 firmware first calls back the person in need of help, then polls family members serially via four paths based on the call status and RC signal. Once answered, the queue is not terminated, and the recording is played in four segments for on-site evidence collection.

[0077] Fifth, existing technologies lack synchronous recording and hardware latching circuits, making recordings easily overwritten and deleted. This application triggers an alarm to simultaneously record 30 seconds of ambient sound and call tone in the firmware. Upon disconnection, the hardware write protection pin locks the encrypted partition of the TF card, preventing the firmware itself from overwriting.

[0078] Sixth, the transmission of diagnostic text in the health bracelet assembly solution would subject the entire device to Class II medical device regulation, resulting in extremely high market entry barriers. This application uses BLE firmware layer to intercept diagnostic text frames and only allows numerical values ​​to pass through. Furthermore, the entire device lacks disease prediction algorithms and only stores raw data, providing double protection to completely avoid qualification risks.

[0079] Seventh, existing technologies rely on cloud computing and audio signal transmission, which fails when the network is disconnected and poses a risk of privacy leaks. This application establishes a local closed loop using a chip and TF card. 4G only supports calls and SMS messages with no upload path; removing the SIM card ensures complete and usable local recognition and recording.

[0080] Eighth, existing equipment alarms are indiscriminate, causing late-night calls that wake family members or indiscriminately muting devices, leading to loss of contact. This application addresses this by first notifying via SMS through the RTC gate control, and then, if there is no response within 5 minutes via the RC, upgrading the firmware to initiate a voice call, balancing quiet operation with the need for emergency rescue.

[0081] This application features seven deeply coupled and bound circuits: isolated power supply, dual-microphone co-source acquisition, hardware noise reduction, language hardware switching, dual-storage parallel dialing, Bluetooth hardware filtering, and OTP timing. If any one of these hardware components is removed, multiple core functions, including self-rescue during system crashes, hardware false alarm prevention, emergency Mandarin switching, and privacy compliance, will simultaneously fail. Furthermore, each hardware unit cannot be separated and used independently.

[0082] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A multi-layer hardware-coupled dual-master fully offline multilingual home-based elderly care emergency monitoring terminal, characterized in that, include: The main control chip, communication module, and real-time clock chip; The negative power supply terminals of the main control chip and the communication module are connected to a single-point ground via a common cathode dual Schottky diode and an isolation bead; the real-time clock chip is connected to an external OTP one-time storage chip via an I2C bus, and the physiological data acquisition cycle is fixed in hardware, and the regular voice alarm is blocked in hardware, only SMS push is retained; the timing signal output terminal of the real-time clock chip is connected to the main control chip, the communication module, the Bluetooth module and the audio acquisition circuit through resistors respectively; The SOS button is directly connected to the interrupt pin of the communication module via a hardware circuit, and this hardware circuit does not pass through the I / O port of the main control chip. The SOS button is equipped with an RC charging and discharging circuit. The output of the RC charging and discharging circuit is connected to a third comparator, and the output of the third comparator is connected to the interrupt pin of the communication module. After the two microphones are combined into a unified sound source through a bandpass filter circuit, they are connected to multiple analog-to-digital conversion pins of the main control chip for acquisition. The channel control terminal of the analog switch is connected to the hardware alarm level output by the logic AND gate. The negative bias voltage pin of the analog switch is provided with negative bias voltage by a negative charge pump. Under the action of the hardware alarm level, the analog switch physically cuts off the dialect audio path and conducts the Mandarin audio path. The two inputs of the AND gate are connected to the outputs of the first comparator and the second comparator, respectively. The first comparator is connected to the human voice threshold level from the audio acquisition circuit, and the second comparator is connected to the noise baseline voltage calculated by the main control chip and output by the digital-to-analog converter pin of the communication module. The communication module is connected to a first storage chip and a second storage chip, which respectively store the number of the person in distress and the number of their family members; The communication module is configured to first call back the person in distress using the number stored in the first storage chip, and then, based on the call status feedback, serially poll the family member numbers in the second storage chip. Once any number is connected, the dialing of the remaining numbers is not terminated. The Bluetooth module has a firmware layer data frame filtering unit, which is used to intercept diagnostic text frames and allow physiological values ​​to pass. The communication module includes an embedded processor and a memory storing emergency mode firmware. The emergency mode firmware is used to independently execute communication scheduling after receiving a trigger signal from the main control chip or a hardware interrupt signal from the SOS button. The main control chip is connected to the TF card to perform local AI calculations and output a trigger signal when an anomaly is detected. The terminal does not have a hardware data transmission path to upload audio data, vital sign data, or AI models to external cloud servers.

2. The monitoring terminal as described in claim 1, characterized in that, The main control chip is the ESP32-S3 chip, the communication module is the A7670 4G communication module, the real-time clock chip is the PCF8563 chip, the analog switch is the CD4053BE analog switch, the logic AND gate is the 74HC08 two-input AND gate, the first, second, and third comparators are all LM393 voltage comparators, the common cathode dual Schottky diodes are BAT54C, the isolation bead is a 0603 packaged 600Ω isolation bead, and the first and second memory chips are both W25Q64 Flash chips. Each LM393 voltage comparator output is connected in series with a 10kΩ pull-up resistor to the 3.3V power supply. The two W25Q64 chips share an SPI bus, and a 74HC logic gate is used to build a bus arbitration circuit to achieve hardware read / write interlocking.

3. The monitoring terminal as described in claim 2, characterized in that, The RC charging and discharging circuit consists of a 1MΩ resistor and a 3.3μF capacitor. The output of the RC charging and discharging circuit is connected to the third comparator, which is an LM393 voltage comparator. The output of each LM393 voltage comparator is connected in series with a 10kΩ pull-up resistor to the 3.3V power supply. The output of the LM393 voltage comparator is connected to the interrupt pin of the communication module. The communication module distinguishes between short press and long press by reading the duration of the interrupt pin's level. When the main control chip of the communication module crashes, it reads the number from the first storage chip and / or the second storage chip according to the emergency mode firmware and performs dialing.

4. The monitoring terminal as described in claim 3, characterized in that, The bandpass filter circuit is a second-order bandpass filter circuit with a high-pass cutoff frequency of 300Hz and a low-pass cutoff frequency of 3400Hz, and is powered by the second power supply domain. The unified audio source is connected to the three analog-to-digital converter pins of the main control chip for time-division multiplexing. The main control chip works with the TF card to store and calculate the ambient noise baseline. The calculated noise baseline value is transmitted to the communication module via SPI, and then output by the digital-to-analog converter pin of the communication module to the inverting input of the second comparator. The audio acquisition circuit is powered by the second power supply domain; when the main control chip crashes, the microphone and audio acquisition circuit can still acquire sound signals, and the iterative update of the noise baseline stops.

5. The monitoring terminal as described in claim 4, characterized in that, The common terminal of the analog switch is connected to the unified audio source output by the audio acquisition circuit. The first channel of the analog switch is connected to the dialect power amplifier, the second channel of the analog switch is connected to the Mandarin power amplifier, the control terminal of the analog switch is connected to the hardware alarm level output by the logic AND gate, the power supply terminal of the analog switch is connected to the power supply voltage, the ground terminal is grounded, and the negative bias voltage pin is connected to the negative bias voltage output by the negative voltage charge pump. The negative voltage charge pump uses an ICL7660 chip and is equipped with a 104 filter capacitor to output a stable -1.5V voltage to supply the VEE pin of the CD4053. When the output of the AND gate is high and connected to the control terminal of the analog switch, the analog switch physically cuts off the dialect audio path and connects the Mandarin audio path; when the main control chip crashes, the negative bias voltage output by the negative charge pump and the hardware alarm level output by the AND gate remain valid.

6. The monitoring terminal as described in claim 5, characterized in that, The RC charging and discharging circuit is used to determine whether the connection is disconnected within 3 seconds after being connected. The emergency mode firmware pre-burned into the communication module's memory is configured as follows: Lock down the multi-level interrupt priority, with the SOS button interrupt and voice recognition interrupt having the highest priority; After the alarm is triggered, the communication module performs the following communication scheduling according to the emergency mode firmware: Controls the dialing of the distress caller's number stored in the first storage chip to call back the distress caller; Based on the call status feedback signal from the communication module and the level signal output by the RC charging and discharging circuit, the answering status is determined and the call is routed to one of the following four processing paths: Path 1: When the person calling for help answers the call, record the audio, hang up, poll the family member's number stored in the second storage chip, and send a text message simultaneously. Path 2: If no one answers, directly poll the family member's number stored in the second memory chip and simultaneously send an urgent text message; Path 3: When the caller is not the one calling for help, the system performs identity verification and simultaneously records the call audio and ambient sound. After hanging up, it polls for and dials the family member's number stored in the second storage chip and simultaneously sends a text message. Path 4: If the call is disconnected within 3 seconds of being connected, the system will directly poll and dial the family member's number stored in the second storage chip and send a text message simultaneously. Of the four processing paths mentioned above, polling is a serial polling method, where dialing of the remaining numbers is not terminated once any number is connected. Once the family member's number is connected, the communication module will automatically play the following sequence according to the emergency mode firmware: prompt message, 30 seconds of ambient sound, call recording, and closing remarks. When the main control chip crashes, the emergency mode firmware can still independently execute the above communication scheduling, but the identity verification and voiceprint comparison functions that rely on the main control chip's AI calculation in path one and path three are unavailable. The four processing paths are downgraded to two: someone answers and no one answers.

7. The monitoring terminal as described in claim 6, characterized in that, The terminal is equipped with hardware timing circuitry for four-layer identity verification, which is performed in the following order: In the first layer, the communication module plays a voice prompt for the name based on the emergency mode firmware, and the first comparator detects whether the other party has a voice response in order to perform name voice matching. The second layer involves the main control chip performing voiceprint comparison on the other party's voice to determine whether it is the person calling for help. The third layer involves the main control chip performing keyword recognition on the other party's voice to determine whether it contains keywords for emergency help. The fourth layer uses an RC charging and discharging circuit for call timing. The RC charging and discharging circuit is reset to zero and starts timing the moment the call is connected. If there is no valid voice within 3 seconds, the comparator connected to the RC charging and discharging circuit outputs a level signal to the communication module, triggering the communication module to send an urgent text message and shorten the redial interval. When the main control chip crashes, the second and third layers become unavailable, and the fourth layer identity verification is downgraded to two layers, that is, only the name voice matching of the first layer and the RC call timing of the fourth layer are retained.

8. The monitoring terminal as described in claim 7, characterized in that, The terminal includes a recording latch circuit; After the alarm is triggered, the communication module synchronously controls the dual microphones to record 30 seconds of ambient sound according to the emergency mode firmware, and encrypts and records the call voice throughout the call. At the moment of disconnection, the communication module outputs a latch pulse according to the emergency mode firmware and locks the recording file in the evidence recording encryption partition of the TF memory card through the hardware write protection pin. The firmware of the communication module cannot overwrite or delete the latched recording file. Once the family member's number is connected, the communication module automatically plays 30 seconds of ambient sound and voice messages in a fixed sequence according to the emergency mode firmware.

9. The monitoring terminal as described in claim 8, characterized in that, The Bluetooth module includes a GATT layer data frame filtering circuit, which is configured to block data frames containing diagnostic text transmitted by the wristband and only allow blood pressure and heart rate values. The real-time clock chip outputs multiple timing signals. Each timing signal is connected across the main control chip, communication module, Bluetooth module and audio acquisition circuit via a current-limiting resistor to trigger the acquisition of physiological values ​​in hardware. The terminal does not store the algorithm program used to generate disease diagnosis or risk assessment conclusions, and does not perform trend analysis calculations on physiological values ​​locally or in the cloud; it only stores the raw data of physiological values.

10. The monitoring terminal as described in claim 9, characterized in that, The TF card is divided into multiple logically encrypted partitions by the built-in AES hardware accelerator of the main control chip; the multiple logically encrypted partitions include at least a dialect lexicon partition, a noise baseline partition, a physiological recording partition, an evidence recording partition, and a system program partition; The first input of the AND gate is connected to the human voice detection output of the first comparator, and the second input of the AND gate is connected to the noise detection output of the second comparator. The noise baseline voltage is calculated by the main control chip, transmitted to the communication module via SPI, and output to the inverting input of the second comparator by the digital-to-analog converter pin of the communication module. When the first comparator detects that the human voice threshold is met and the second comparator detects that the ambient noise is lower than the noise baseline voltage, the logic AND gate outputs a hardware alarm interrupt level.

Images