SafeSwallow: A Compact Closed-Loop Wearable Neuroprosthesis for Oropharyngeal Dysphagia—Architecture, Algorithms, Experimental Design, and Dual-Track Evaluation

Abstract

Oropharyngeal dysphagia impairs oral and/or pharyngeal swallowing and can produce aspiration, residue, delayed onset, and incomplete hyolaryngeal elevation; esophageal dysphagia is outside the present scope. This paper presents SafeSwallow, a compact wearable neuroprosthesis for oropharyngeal assistance focused on hyolaryngeal/pharyngeal elevation. The architecture integrates around-ear/glasses EEG for anticipatory arming, submental sEMG, laryngeal bioimpedance (BI), contact acoustics, and IMU, with across-swallow iterative learning control under a Tier-0 safety supervisor. Evaluation used two non-clinical tracks: (i) synthetic closed-loop experiments for implementation verification, hard-plant multi-seed uncertainty, and timing-margin analysis; and (ii) public VFSS-aligned HRCA data (N_subj = 12) for real-signal detection/scheduling without BI/EEG/FES. Easy seed-7 is paper-matched (Q1 = 1.0; elev_err = 0.116). Across 20 hard-plant seeds, TinyML AUC = 0.978 ± 0.008; among detections Q1|detected = 0.963 ± 0.072, while unconditional Q1 ≈ 0.295 given miss = 0.694 ± 0.035, and false_stim = 0.216 ± 0.037—infeasible by the paper’s own criteria. On HRCA, improved detect 0.949 → 0.983 (Δ = +3.39 pp). Clinical translation requires paired multimodal data, measured EMD, and prospective human validation.

1. Introduction

1.1. Clinical Motivation: Oropharyngeal Dysphagia Beyond Aspiration

Swallowing is a rapid, highly coordinated sensorimotor sequence that transports a bolus from the oral cavity through the pharynx into the esophagus while diverting the airway. Airway protection depends on appropriately timed hyolaryngeal elevation, epiglottic deflection, vocal-fold closure, and coordinated tongue-base retraction. Failure in timing, amplitude, sensation, or coordination produces clinically important dysphagia [1,2,3,4].

Clinical scope. SafeSwallow targets oropharyngeal dysphagia: impairment of the oral and/or pharyngeal phases of swallowing. In the four-phase model these phases are (1) oral preparatory, (2) oral transit, (3) pharyngeal, and (4) esophageal; in the three-phase model the oral preparatory and oral transit phases are combined into a single oral phase, followed by pharyngeal and esophageal phases. Sensing is intended to support monitoring across oral and pharyngeal (oropharyngeal) phases. Assistive actuation focuses on hyolaryngeal elevation for pharyngeal airway protection. Esophageal dysphagia and esophageal-phase actuation are explicitly out of scope.

The clinical problem is broader than aspiration alone. Important deficits include impaired oral bolus formation or propulsion, premature spill toward the pharynx, post-swallow residue, reduced sensation and awareness of residue, delayed pharyngeal initiation, and incomplete hyolaryngeal elevation [1,5,6,7,8,9]. These failures compromise both airway safety and nutritional efficiency and can contribute to pneumonia, dehydration, feeding-tube dependence, prolonged hospitalization, and loss of independence. A wearable that focuses only on aspiration therefore addresses only one part of the dysphagia phenotype.

SafeSwallow is consequently framed as an oropharyngeal monitoring and assistance platform with an acute engineering focus on airway-protective hyolaryngeal assistance during the pharyngeal phase. The preferred embodiment is a discrete ear–chin form factor intended for continuous meal-time wear. Future modes for oral assistance and post-swallow residue clearance are conceptual extensions intended to share the same Tier-0 safety architecture; they are not demonstrated interventions in the present study.

1.2. Problem Statement and Hard Real-Time Constraint

The engineering problem is to deliver useful assistive force early enough in the swallow for airway protection while avoiding false stimulation. In this study, pharyngeal onset denotes the model-/VFSS-referenced start of the pharyngeal phase (onset of the principal hyolaryngeal elevation ramp). We model the mean elevation-ramp duration as T_elev ≈ 390 ms and define the first quarter of this ramp as the Q1 intervention window (T_q = T_elev/4 ≈ 97.5 ms after pharyngeal onset). Important caveat (brought forward from the Methods formulation): the 390 ms value and the resulting ≈ 97.5 ms deadline are author-defined engineering priors chosen to provide a reproducible timing target for controller evaluation; they are not derived as universal physiological constants from references [10,11,12,13]. Those citations motivate that timely laryngeal elevation and temporally coordinated stimulation can augment airway-protective motion. A force arriving after Q1 is scored as a timing miss in the present engineering evaluation; this scoring rule does not claim that post-Q1 force is clinically ineffective in all patients.

Three latency sources consume this budget: causal filtering in the detection chain, residual edge inference latency, and EMD between electrical stimulation and useful mechanical force. The resulting design tension is fundamental: reactive detection improves specificity but consumes timing margin; anticipatory arming improves timing margin but must not be permitted to fire on its own. SafeSwallow resolves this tension by allowing EEG to pre-arm or pre-charge while requiring peripheral multimodal confirmation before energy delivery.

The second problem is adaptation. A fixed stimulation dose cannot directly compensate for fatigue, electrode–skin impedance changes, or subject-specific physiology. The proposed controller therefore measures post-stimulus elevation from BI and optional acoustics/IMU signals and applies iterative learning control (ILC) to update the stimulation dose from swallow k to swallow k + 1 (across consecutive swallows), not as high-bandwidth within-swallow correction, while respecting hard saturation limits. A successful response in the engineering evaluation is defined by Q1-timed force delivery together with reduced normalized elevation error relative to a reference elevation target.

1.3. State of the Art and Unmet Need

Assessment methods remain centered on videofluoroscopic swallow study (VFSS) and fiberoptic endoscopic evaluation of swallowing (FEES). These modalities provide critical anatomical and temporal ground truth but are not practical continuous sensors during ordinary meals [8,14,15,16]. Compensatory and rehabilitative behavioral approaches (diet modification, maneuvers, and exercise) remain essential, but they do not generally provide millisecond-scale mechanical assistance at every swallow [17]. Assistive and clinic-based stimulation approaches differ in intent: surface neuromuscular electrical stimulation (NMES) can influence hyolaryngeal motion [18,19,20,21], and self-triggered stimulation has demonstrated linking a swallow event to stimulation [12,13]; hospital pharyngeal electrical stimulation systems primarily target treatment-session neuroplasticity rather than portable per-swallow mechanical assistance [22,23]. SafeSwallow is positioned as a wearable assistive technology for oropharyngeal (not esophageal) support, not as a replacement for clinical assessment.

Wearable sensing has progressed substantially. Suprahyoid sEMG provides a useful activation proxy but is vulnerable to speech, chewing, co-contraction, and head motion [24]. Neck BI provides information related to hyolaryngeal movement and can improve onset detection when combined with EMG [10,25]. HRCA combines contact-microphone and accelerometer signals and supports machine-learning identification of swallows from wearable-compatible signals [26,27]. Around-ear EEG technologies such as cEEGrid-class electrodes provide a path to discreet cortical sensing [28], while soft submental patches support unobtrusive peripheral measurement [29,30].

The gap addressed here is therefore not simply sensing or stimulation. It is the integration of (1) anticipatory intent information, (2) multimodal swallow verification, (3) explicit latency compensation, (4) closed-loop elevation feedback, (5) per-swallow dose adaptation across swallows, and (6) deterministic safety overrides in a compact wearable focused on oropharyngeal assistance. Esophageal-phase intervention is out of scope.

1.4. Objectives, Hypotheses, and Contributions

Explicit scope statement: the proposed closed-loop SafeSwallow system was not evaluated in living human subjects. All closed-loop stimulation results are from a physiology-inspired synthetic plant; the public HRCA track evaluates sensing/verification/scheduling components on real microphone and accelerometer recordings with VFSS-aligned labels, without BI, EEG, or delivered FES. Dual-track roles: synthetic = implementation verification, timing-margin analysis, and adaptation comparison; HRCA = robustness of causal front-end metrics under real signal noise. Neither track establishes clinical efficacy. The primary objective is to evaluate whether the proposed controller can satisfy stated engineering feasibility criteria for Q1-timed assistive force under noise, stochastic compute delay, and Parkinsonian impairment models while improving elevation tracking over matched open-loop dosing. Four engineering hypotheses were predefined:

H1. 

Anticipatory arming is required to recover Q1 timing margin for delayed-onset phenotypes; explicit EMD compensation is retained as a latency-scheduling term but is not claimed, on the hard plant, to further improve Q1 beyond arming alone.

H2. 

BI ∩ sEMG ∩ TinyML verification with abstain-under-uncertainty can limit false stimulation within the engineering envelope.

H3. 

ILC dose adaptation reduces normalized elevation error relative to fixed open-loop dosing.

H4. 

Richer causal features and anticipatory scheduling modestly improve HRCA detection and modeled timing metrics relative to a baseline envelope/verifier pipeline (audit Δ detect ≈ +3.4 pp).

2. Proposed SafeSwallow Approach

2.1. Wearable Hardware Configuration

The preferred embodiment consists of four compact modules. First, a behind-ear hub contains the system-on-chip (SoC), an optional neural-processing unit (NPU) accelerator, power management, battery, charge-balanced stimulator, and a tactile OFF control. Second, a thin around-ear EEG film and/or glasses–temple electrodes provide an anticipatory intent stream; a forehead electrode is treated as a fallback rather than a preferred configuration. Third, a submental U-film combines small sEMG sensing contacts and FES pads directed toward reachable elevation musculature. Fourth, a laryngeal sensing stamp carries BI electrodes, a contact microphone, and a tri-axial inertial measurement unit (IMU) near the laryngeal prominence.

Clinical mechanism of each sensor/actuator: (i) around-ear/glasses EEG estimates preparatory cortical/intent features to pre-arm or pre-charge before swallow onset—EEG cannot sole-authorize stimulation; (ii) submental sEMG senses elevator muscle co-activation to gate plausibility of an ongoing swallow; (iii) laryngeal BI tracks impedance changes related to hyolaryngeal motion for onset preselection and post-stimulus elevation feedback; (iv) contact microphone and IMU provide acoustic/kinematic corroboration to discriminate swallowing from speech, chewing, coughing, and head motion and are central to the public HRCA evaluation; (v) submental FES pads deliver assistive force intended to facilitate hyolaryngeal elevation during the pharyngeal phase; (vi) the tactile OFF control is a user-initiated safety inhibit that forces zero current. Figure 1, Figure 2, Figure 3 and Figure 4 illustrate the preferred compact wearable configuration, the anterior person-mounted view, the multimodal sensor/actuator suite with anatomical placements, and the Tier-0 user touch OFF path.

Figure 1. Preferred SafeSwallow compact wearable configuration: behind-ear compute/stimulation hub, around-ear EEG film, submental sense/stimulation contacts, and laryngeal sensing stamp.

Figure 2. Anterior person-mounted view showing the submental sense/stimulation contacts and laryngeal sensing stamp.

Figure 3. Multimodal sensor/actuator suite, control roles, and compact anatomical placements. EEG provides intent arming only; sEMG gates co-activation; BI provides onset and elevation feedback; acoustics/IMU support verification; FES provides assistive force; the kill-switch inhibits energy delivery.

Figure 4. Tier-0 user touch OFF path. Activation disables the high-voltage rail, commands zero current, and latches the system in a safe state until manual re-arm and self-test.

2.2. Hierarchical Controller and Information Flow

SafeSwallow is organized as a hierarchical controller. Tier 0 contains non-learned safety logic that cannot be overridden by learned modules. Tier 1 implements reactive stimulation authorization using BI preselection, sEMG co-activation, and artificial-intelligence (AI) swallow verification. Tier 2 adds anticipatory onset prediction from ear/glasses EEG and early peripheral signals. Tier 3 estimates achieved elevation and fatigue and updates the next-swallow dose using ILC. The platform is intentionally structured so that EEG can arm the path but cannot sole-fire FES. Figure 5, Figure 6 and Figure 7 summarize the hierarchical closed-loop architecture, the signal/decision/actuation flow, and the end-to-end information-flow ladder.

Figure 5. Hierarchical closed-loop control architecture with Tier-0 safety overrides and three control tiers: reactive verification, anticipatory feedforward, and feedback/learning.

Figure 6. Signal/decision/actuation flow: multimodal sensing, causal feature extraction, intent estimation and swallow verification, EMD-compensated scheduling, FES delivery, and post-action feedback.

Figure 7. End-to-end information-flow ladder. The seven stages are sensing, estimation, delay accounting, decision, stimulation, validation, and adaptation/safety.

Controller-module pipeline overview (textual flowchart): (1) Sensing—EEG, sEMG, BI, acoustics, IMU streams are sampled causally; (2) A0 Safety supervisor—kill-switch, impedance, watchdog, refractory, and charge/current bounds can inhibit energy on every cycle (non-overridable); (3) A1 Feature front-end—builds a causal multimodal feature vector without look-ahead; (4) A2 Anticipatory arming—may pre-charge and compute a provisional schedule within horizon T_ant when confidence is high, but cannot fire alone; (5) A3 Swallow verifier—probabilistic swallow vs. non-swallow decision with abstain-under-uncertainty; (6) A4 Reactive fire scheduler—if armed and all gates pass, schedules t_f with EMD compensation and delivers charge-balanced FES, then refractory; (7) A5 Observer/ILC—estimates elevation and updates dose for the next swallow; (8) A6 (HRCA track only)—improved microphone/accelerometer pipeline for public-data detection and modeled Q1 scoring. A single linked vector summary figure remains desirable and is listed as follow-up artwork. Module flows corresponding to these steps are detailed in Figure 8, Figure 9, Figure 10, Figure 11, Figure 12, Figure 13, Figure 14 and Figure 15.

2.3. Sensor Roles and Decision Logic

EEG is used as a preparatory (anticipatory arming) signal only; it is not the sole authority for stimulation. sEMG measures activity of submental elevators and forms a co-activation gate tied to oral/pharyngeal elevator recruitment. BI is measured at the laryngeal region and is used both for onset preselection and as an elevation feedback proxy for pharyngeal hyolaryngeal motion. Contact acoustics and IMU provide additional evidence to discriminate swallowing from speech, chewing, coughing, and head-motion confounders and are especially useful in the public HRCA evaluation. None of these sensors targets esophageal peristalsis.

The decision path is intentionally causal. Short windows are buffered without non-causal look-ahead. A candidate swallow is authorized only when all required logical gates pass and no Tier-0 inhibit is active. Otherwise, the system abstains. This design explicitly treats a false-positive electrical stimulus as more consequential than a missed assistive opportunity.

3. Mathematical Formulation

3.1. Q1 Timing Deadline

$$t_q=t_0+{\displaystyle \frac{T_h}{4}}$$

(1)

$t_q$ is the end of the first-quarter ($Q_1$) assistive-force window, referenced to the onset of the pharyngeal phase.

t₀ is the pharyngeal onset time of the swallow.

Interpretation of (1): This is a deliberately conservative engineering timing definition. The model does not claim that Q1 is a universal physiological cutoff; it defines a reproducible target interval for the present controller evaluation. The nominal value follows directly from the reported elevation prior, Th ≈ 0.390 s, so T_q = Th/4 ≈ 0.0975 s. The physiological premise that timely laryngeal elevation contributes to airway protection and that stimulation can augment laryngeal movement is supported by Burnett et al. [12,13]. Round 2 reporting note: empirical Q1 may be computed among detections (Q1|detected) or unconditionally over all labelled swallows (unconditional Q1 ≈ Q1|detected × detection rate). Hard-plant headline Q1 = 0.963 ± 0.072 is Q1|detected; with miss = 0.694 ± 0.035, unconditional Q1 ≈ 0.295.

$T_h$ is the modeled hyolaryngeal elevation-ramp duration; the present engineering prior uses approximately 0.390 s.

The Q1 window is therefore approximately 0.0975 s for the nominal 0.390 s elevation ramp.

3.2. Bioimpedance and sEMG Gating

$$b\left(t\right)=\mathbf{1} \left\{Z_0-Z\left(t\right)\ge {\theta }_b\right\}$$

(2)

$b\left(t\right)$ ∈ {0, 1} is the BI preselection gate.

$Z\left(t\right)$ is the measured tissue impedance in ohms, and $Z_0$ is a slowly varying causal baseline.

${\theta }_b$ is the minimum impedance-drop threshold; the synthetic controller used 0.18 Ω as an engineering prior.

Interpretation of (2)–(3): The BI gate b(t) is a preselection mechanism, not a diagnosis of swallowing. Riebold et al. showed that combining BI and surface electromyography (EMG) improved swallow-onset detection relative to EMG alone in a patient dataset, motivating the division of labor used here [10]. The threshold θ_b is an engineering/calibration parameter; it is not a universal biological constant. Likewise, θ_m is subject dependent because absolute sEMG amplitudes vary with electrode placement, tissue impedance, and muscle activation.

$$m\left(t\right)=\mathbf{1} \left\{\mathrm{R}\mathrm{M}\mathrm{S}\left[s_m\right]\left(t\right)\ge {\theta }_m\right\}$$

(3)

$m\left(t\right)$ ∈ {0, 1} is the submental co-activation gate.

$r_m\left(k\right)$ is the causal root-mean-square (RMS) magnitude of the band-passed $s_m$ signal.

${\theta }_m$ is a subject-calibrated activation threshold.

3.3. Learned Swallow Verification and Fire Authorization

$$p_s\left(t\right)=f_{\theta }\left(x_t\right)\in \left[0,1\right], a\left(t\right)=\mathbf{1} \left\{p_s\left(t\right)\ge {\theta }_s\right\}$$

(4)

p_sw(t) ∈ [0, 1] is the estimated probability that the current causal feature window represents a swallow.

$f_{\theta }$ is the trained RF/MLP/ensemble verifier, and $x_t$ is the multimodal causal feature vector.

${\theta }_s$ is the operating threshold; the synthetic implementation used a minimum authorization probability of 0.55 and selected the operating point using training-fold $F_1$.

Interpretation of (4)–(5): p_s(t) = f_θ(x_t) is a probabilistic classifier output. The threshold θ_s is selected on grouped training/validation folds and then frozen before the held-out evaluation. The logical authorization a(t) is intentionally more restrictive than a classifier decision: a high p_s(t) is necessary but not sufficient because the Tier-0 conditions can independently inhibit stimulation. This separation makes the learned component advisory within a deterministic safety envelope rather than the final actuator authority.

$$\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{e}\left(t\right)=b\left(t\right)m\left(t\right)a\left(t\right)s\left(t\right)$$

(5)

$\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{e}\left(t\right)$ ∈ {0, 1} is the final energy-delivery authorization.

The predicate $h$ represents the user OFF state.

The predicate $r$ represents the post-stimulation refractory lockout interval.

$s\left(t\right)$ represents the deterministic Tier-0 safety gate, which is false for out-of-range electrode impedance, watchdog failure, refractory lockout, user OFF state, or charge/current violation.

3.4. EMD-Compensated Scheduling

$$t_f=t_d+T_c-T_e$$

(6)

$t_f$ is the electrical stimulus onset time.

Interpretation of (6)–(7): t_f is scheduled earlier than confirmation by the estimated electromechanical delay T_e. The relation t_a = t_f + T_e is an accounting identity for the expected force-arrival time, not a measured subject-specific transfer function. The present study uses T_e≈50 ms as an engineering prior. Burnett et al. demonstrated the feasibility of swallow-triggered FES and the importance of temporal synchronization between the swallow and stimulation [13]. In a clinical implementation, T_e must be measured for the final electrode geometry, waveform, muscle targets, and subject.

$t_d$ is the time at which swallow confirmation becomes available.

$T_c$ is the residual computation/inference delay after confirmation.

$T_e$ is the electromechanical delay; the present engineering prior is approximately 0.050 s.

$$t_a\approx t_f+T_e$$

(7)

$t_a$ is the estimated time at which useful assistive force reaches the target musculature.

Under the $Q_1$ success criterion, $t_a$ must be less than or equal to $t_q$.

3.5. Elevation Error and Iterative Learning Control

$$e_k=z_k^{\mathrm{*}}-{\widehat{z}}_k$$

(8)

k indexes successive swallows.

$z_k^{\mathrm{*}}$ is the desired or reference elevation for swallow k.

Interpretation of (8)–(9): The update is an iterative learning control law applied from one swallow to the next. The error e_k compares the desired elevation target z_k* with the observed elevation estimate ẑ_k. If the observed elevation is below target, the update increases u_{k + 1}; if it is above target, the update decreases the dose, subject to saturation. This is consistent with the repetitive-trial viewpoint of ILC described by Bristow, Tharayil, and Alleyne [31]. The study does not claim formal stability for the nonlinear human swallowing plant; the learning gain L and saturation bounds are engineering parameters to be identified and validated experimentally.

${\widehat{z}}_k$ is the estimated achieved elevation obtained from BI and optional acoustic/IMU observations.

$e_k$ is the swallow-to-swallow elevation tracking error.

$$u_{k+1}=\mathrm{s}\mathrm{a}\mathrm{t} \left(u_k+L{e}_k;\hspace{0.17em}{u}_l,u_h\right)$$

(9)

$u_k$ is the stimulation dose, represented in the present model primarily by current amplitude in milliamperes.

L is the ILC learning gain.

Interpretation of (10)–(11): The binary cross-entropy objective is the standard negative log-likelihood for probabilistic binary classification and is widely described in statistical pattern recognition [32]. The F1 score combines precision and recall through their harmonic mean; it is particularly useful here because class imbalance and the asymmetric consequence of false stimulation make raw accuracy insufficient [33]. The selected threshold τ* is therefore an operating point chosen from training/validation folds rather than from the held-out test set.

sat(.) clamps the update to the hardware-safe interval [$u_l$, $u_h$].

The controller therefore adapts across repeated swallows while preserving explicit safety bounds.

3.6. Verifier Training and Operating Point

$$J_c=-\sum _i\left[y_i\mathrm{l}\mathrm{o}\mathrm{g}{p}_i+\left(1-y_i\right)\mathrm{l}\mathrm{o}\mathrm{g}\left(1-p_i\right)\right]$$

(10)

$J_c$ is the binary cross-entropy objective.

y_i ∈ {0, 1} is the ground-truth label for sample i, and p_i = $f_{\theta }$($x_i$) is the predicted swallow probability.

$${\tau }^{\mathrm{*}}=\underset{\tau }{\mathrm{a}\mathrm{r}\mathrm{g} \mathrm{m}\mathrm{a}\mathrm{x}}{F}_1\left(\tau \right)$$

(11)

${\tau }^{\mathrm{*}}$ is selected from subject-grouped training folds to balance precision and recall under class imbalance.

$F_1$($\tau$) denotes the harmonic mean of precision and recall at candidate threshold $\tau$.

Interpretation of (12)–(14): (12) is a linear discrete-time state-space approximation; (13) is the measurement-update form of the Kalman filter, following the state-estimation framework introduced by Kalman [34]. The matrices A, B, and C are not assumed to be universal physiological constants; they are model parameters representing local state propagation, stimulation influence, and measurement mapping. The process covariance and measurement covariance describe uncertainty in latent-state evolution and sensor observations. Equation (14), Q_p = I_pτ_p, follows directly from the definition of charge as current integrated over pulse duration. The resulting density ρ_q = Q_p/A_e is used as a safety accounting variable, while the final permissible limit must be determined from the final electrode geometry, waveform, tissue-interface characterization, and applicable medical-device safety requirements. IEC 60601-2-10 specifies requirements for the basic safety and essential performance of nerve and muscle stimulators [35]. Tissue-damage thresholds under therapeutic electrical stimulation are discussed by Cogan et al. [36].

3.7. Elevation Observer and Electrical Safety Constraint

Interpretation of (15): The HRCA dataset contains audio/accelerometer samples at 4 kHz and reference VFSS timing at 60 frames/s. The frame-to-sample conversion therefore maps a video frame index into the nearest equivalent signal sample using the ratio 4000/60. This is a synchronization operation defined by the dataset sampling rates, not a learned parameter [26,27].

$${\mathbf{x}}_{t+1}=A{\mathbf{x}}_t+B{u}_t+{\mathbf{w}}_t, {\mathbf{y}}_t=C{\mathbf{x}}_t+{\mathbf{v}}_t$$

(12)

x_t is the latent elevation/fatigue state; $u_t$ is stimulation input; $y_t$ contains BI and optional acoustic/IMU measurements.

A, B, and C are the state, input, and output matrices; $w_t$ and $v_t$ represent process and measurement noise.

$${x\_f}_t={x\_p}_t+K_t \left({\mathbf{y}}_t-C{x\_p}_t\right)$$

(13)

The predicted state is ${x\_p}_t$, and the filtered estimate is ${x\_f}_t$.

$K_t$ is the Kalman gain, and the bracketed term is the measurement innovation.

$$Q_p=I_p{\tau }_p, {\displaystyle \frac{Q_p}{A_e}}\le {\rho }_q$$

(14)

$Q_p$ is the charge delivered during a single phase of a biphasic pulse.

$I_p$ denotes pulse-current amplitude, ${\tau }_p$ is pulse-phase width, and $A_e$ is electrode contact area.

${\rho }_q$ is the enforced charge-density ceiling implemented by the Tier-0 safety supervisor.

$$n_s=n_f{\displaystyle \frac{f_s}{f_v}}$$

(15)

Equation (15) maps a VFSS frame index to the corresponding signal-sample index. Here, ns is the HRCA sample index, n_f is the VFSS video-frame index, fs is the HRCA signal sampling frequency (4000 Hz), and f_v is the VFSS frame rate (60 frames/s). Thus, ns = n_f(fs/f_v) converts the video-domain time base to the sensor-signal time base without introducing a learned parameter. This synchronization convention follows the sampling characteristics of the public HRCA dataset [26,27].

The conversion maps a VFSS frame index to the corresponding HRCA sample index.

4. Algorithms and Implementation

4.1. Safety Supervisor and Causal Feature Front-End

Figure 8 summarizes the causal feature front-end: it computes EEG intent features, band-passed sEMG RMS, BI drop and slope, multi-band microphone envelopes, spectral moments, and an IMU superior–inferior displacement proxy without non-causal look-ahead. Figure 9 summarizes the deterministic safety supervisor: it monitors the kill-switch, electrode impedance, watchdog state, refractory state, and charge/current bounds on every control cycle; a fault immediately disables the high-voltage rail and forces the commanded stimulation current to zero.

Causal Feature Front-End (Figure 8).

Figure 8. Causal feature extraction and construction of the multimodal feature vector (module A1 flow).

Figure 8. Causal feature extraction and construction of the multimodal feature vector (module A1 flow).

As shown in Figure 8, the feature front-end converts the heterogeneous sensor streams into a compact, causal feature vector. EEG features are used for anticipatory intent estimation; surface EMG is summarized by a causal RMS envelope; BI contributes baseline-relative drop and slope; microphone and inertial channels contribute envelope, spectral, and superior–inferior-motion features. No future samples are used. The feature layer is deterministic, calibrated, and therefore does not constitute the learned swallow verifier.

Deterministic Safety Supervisor (Figure 9).

Figure 9. Deterministic safety supervision and inhibit logic (module A0 flow).

Figure 9. Deterministic safety supervision and inhibit logic (module A0 flow).

As shown in Figure 9, the safety supervisor is the non-learned supervisory layer. At every control cycle it evaluates the user kill-switch, electrode impedance, watchdog status, refractory lockout, and hard current/charge limits. If any inhibit condition is asserted, the high-voltage rail is disabled, and the requested dose is forced to zero. It therefore has no training phase and no learned parameters. Its purpose is to make safety monotonic: adding a learned model cannot weaken the hard constraints. Figure 10 summarizes how these modules compose the reported experiments.

Figure 10. Control modules used in the reported experiments. A0 is the always-on safety supervisor; A1–A5 comprise the real-time control path; A6 is used for the public HRCA evaluation.

Figure 10. Control modules used in the reported experiments. A0 is the always-on safety supervisor; A1–A5 comprise the real-time control path; A6 is used for the public HRCA evaluation.

4.2. Anticipatory Arming and Swallow Verification

Figure 11 summarizes the probabilistic swallow verifier: it discriminates swallow versus non-swallow events from the multimodal feature vector using a compact random forest (RF), multilayer perceptron (MLP), or ensemble, with abstention below the operating threshold. Figure 12 summarizes anticipatory arming: it predicts imminent swallow onset from EEG and early peripheral features and, when confidence exceeds an arming threshold and the predicted onset lies within a configured horizon, may pre-charge the compliance rail and compute a provisional fire time without allowing EEG alone to authorize stimulation.

Swallow Verifier (Figure 11).

As shown in Figure 12, the anticipatory module predicts whether a swallow is approaching and, when possible, estimates the time to onset. The model can be implemented with a temporal convolutional network or gated recurrent unit, but in all cases its authority is limited to arming and pre-computation. If confidence c exceeds θ_a and the predicted time-to-onset lies within the horizon T_ant, the rail may be pre-charged and a provisional fire time computed. It cannot by itself authorize stimulation. This separation is central to the safety architecture.

Figure 11. Probabilistic swallow verification and abstention (module A3 flow).

Figure 11. Probabilistic swallow verification and abstention (module A3 flow).

As shown in Figure 11, the verifier performs the final probabilistic discrimination of swallow versus non-swallow events. Candidate implementations include a random forest, multilayer perceptron, or ensemble. Training is subject-grouped, and the probability threshold θs is selected only on training/validation folds. At runtime, a prediction below θs produces abstention rather than stimulation. The diagram makes the decisive role of the probability gate explicit.

Anticipatory Arming (Figure 12).

Figure 12. Anticipatory onset prediction, confidence gate, and provisional scheduling (module A2 flow).

Figure 12. Anticipatory onset prediction, confidence gate, and provisional scheduling (module A2 flow).

4.3. Reactive Fire Scheduling, Observer, and ILC

Figure 13 summarizes the improved HRCA evaluation pipeline used for the public-data track: multi-band envelopes, superior–inferior displacement proxies, tri-axial consensus gating, a class-balanced RF+MLP ensemble, acoustic corroboration, anticipatory rising-edge triggers, and EMD-compensated scoring. Figure 14 summarizes the elevation observer and swallow-to-swallow ILC adaptation: it observes achieved elevation, computes the elevation error, and updates the next-swallow dose under saturation bounds. Figure 15 summarizes the reactive fire scheduler: it executes only when the system is armed and all BI, sEMG, AI, and Tier-0 conditions are satisfied, applies the EMD-compensated schedule, delivers a charge-balanced biphasic burst, and enters refractory.

Observer and ILC Adaptation (Figure 14).

Improved HRCA Evaluation Pipeline (Figure 13).

Figure 13. Improved HRCA signal processing, ensemble verification, and anticipatory Q1 scoring (module A6 flow).

Figure 13. Improved HRCA signal processing, ensemble verification, and anticipatory Q1 scoring (module A6 flow).

As shown in Figure 13, the public-data pipeline does not claim to reconstruct the full SafeSwallow sensing stack because BI and EEG are absent from the corpus. Instead, it improves the available microphone/accelerometer path with multi-band causal features, superior–inferior motion proxies, tri-axial consensus, a class-balanced RF+MLP ensemble, acoustic corroboration, and anticipatory rising-edge timing. The final output is a detection/Q1 score against VFSS-aligned labels.

Figure 14. Elevation observation, error computation, and swallow-to-swallow ILC adaptation (module A5 flow).

Figure 14. Elevation observation, error computation, and swallow-to-swallow ILC adaptation (module A5 flow).

As shown in Figure 14, the observer/ILC module updates the next-swallow stimulation dose. First, BI and optional microphone/IMU measurements are mapped to an elevation/fatigue state estimate. The elevation error e_k is then passed through the ILC learning law to update u_{k + 1}, with saturation and optional rate limiting. The loop operates across swallows, not as an unconstrained within-swallow high-bandwidth controller.

Reactive Fire Scheduler (Figure 15).

Figure 15. Gated firing, EMD compensation, FES delivery, and refractory lockout (module A4 flow).

Figure 15. Gated firing, EMD compensation, FES delivery, and refractory lockout (module A4 flow).

As shown in Figure 15, the reactive fire scheduler is the timing-critical actuator path. It requires the system to be armed and all peripheral and Tier-0 gates to be clear. It then evaluates t_f = t_d + T_c − T_e, delivers the charge-balanced FES burst, and starts the refractory interval. This is the module in which the timing model, actuator delay, and safety gates directly meet.

5. Experimental Design and Methods

5.1. Synthetic Closed-Loop Experiment

The synthetic experiment was designed as a controlled stress test rather than a clinical validation study. A physiology-inspired plant generated multimodal signals at 1 kHz, including BI, sEMG, microphone, IMU, and optional EEG features. Healthy priors used a peak elevation of approximately 12 ± 1.2 mm and an elevation duration of 0.39 ± 0.03 s. Parkinsonian phenotypes were represented by severity tiers with reduced voluntary gain, delayed onset, prolonged elevation, faster fatigue, and medication ON/OFF scaling. These are engineering priors, not patient-specific claims.

Confounders resembling speech, chewing, and coughing were injected to stress false-stimulation behavior. The controller used ${\theta }_b$ = 0.18 ohm, a 0.55 swallow-probability authorization threshold, 50 ms EMD, a nominal 12 mA dose with 4–25 mA limits, approximately 0.60 s stimulation bursts with a 0.04 s ramp, a 1.0 s refractory interval, and a modeled compute delay of approximately 8 ± 3 ms.

The classifier training set contained 8 subjects with 20 swallows and 12 confounders per subject. A held-out classifier evaluation set contained 4 unseen subjects with 15 swallows and 10 confounders per subject. The final closed-loop and matched open-loop evaluation used 8 unseen test subjects: 4 healthy and 4 Parkinsonian. Each contributed 25 swallows and 10 confounders in each condition, producing 280 held-out trials per condition (200 swallows and 80 confounders). A fixed random seed of 7 was used.

The subject-grouped split is essential because random window-level splitting could place highly correlated windows from the same synthetic subject in both training and test data, inflating performance estimates. The present implementation therefore treats the subject as the grouping unit.

5.2. Engineering Feasibility Criteria and Metrics

The study deliberately distinguishes engineering feasibility from clinical efficacy. Formal event definitions: miss = mean(missed | true swallow); false stimulation = mean(fired|confounder); abstain = low-confidence safety path (distinct from silent reject such as no_bi_preselect). Easy smoke seed-7: abstain_all = 0.250, abstain_swallow = 0.000, abstain_confounder = 0.875, silent_reject_conf = 0.125, miss = 0.000, false_stim = 0.000 (healthy abstain_all = 0.286 with confounder abstain = 1.000; Parkinsonian abstain_all = 0.214 with confounder abstain = 0.750 and silent_reject_conf = 0.250). Hard-plant seed-7 breakdown (same definitions): abstain_all = 0.757, abstain_swallow = 0.710, miss = 0.710, false_stim = 0.125. A controller configuration was considered feasible when Q1 force success was at least 80%, missed swallows ≤ 15%, false stimulation ≤ 5%, and mean normalized elevation error ≤ 0.35. Per-trial logs included detection and force latency, abstention, modeled airway-protection status, stimulation amplitude, and elevation error. Default online association of detections to labelled onsets used an asymmetric window of approximately [t0 − 0.45 s, t0 + 0.55 s]; post hoc symmetric half-width sweeps are reported separately for robustness. Table 1 summarizes the synthetic experimental design and controller settings.

Table 1. Synthetic experimental design and controller settings.

Parameter	Setting
Simulation rate	1 kHz
Healthy peak elevation prior	12 ± 1.2 mm
Elevation duration prior	0.39 ± 0.03 s
BI preselection threshold	0.18 ohm
Verifier authorization threshold	0.55
EMD prior	50 ms
Compute delay	8 ± 3 ms
Stimulation dose	12 mA nominal; 4–25 mA bounds
Burst/ramp	0.60 s/0.04 s
Refractory	1.0 s
Final held-out test	280 trials per condition

5.3. Public HRCA Evaluation

The public-data experiment used the Swallowing High Resolution Cervical Auscultation Signals corpus, available through Zenodo (Version v1) under DOI 10.5281/zenodo.4539695. The corpus contains contact-microphone and tri-axial accelerometer signals sampled at 4 kHz with VFSS-derived swallow onset/offset labels [26,27]. A 100-file subset containing 148 labeled swallows from N_subj = 12 distinct subjects (ns011–ns028) was analyzed under subject/file-aware partitions; full-corpus evaluation remains important follow-up. Because the corpus lacks BI and EEG, the experiment tests real-signal sensing, verification, and scheduling components rather than the complete multimodal closed-loop, and no FES was delivered.

VFSS frame indices were converted to samples using Equation (15), which assumes a 60 frames/s VFSS time base as described for the cited HRCA resource; many clinical VFSS protocols use 30 fps, so frame-rate assumptions should be re-verified for any full-corpus extension. Subject/file-aware GroupShuffleSplit partitions were held fixed between baseline and improved methods in the original compare, and were repeated with n = 10 subject-grouped splits for uncertainty analysis (primary reported value; an earlier n = 8 exploratory split is superseded). The baseline pipeline used single-band causal envelopes, a random-forest verifier, and reactive timing. The improved pipeline added multi-band causal envelopes, SNR-proxy denoising, a superior–inferior displacement proxy, tri-axial consensus gating, a class-balanced RF+MLP ensemble, an F1-optimized threshold, acoustic dual-gating, anticipatory rising-edge detection, and EMD-compensated scheduling. Detection rate is an event-level metric over labelled swallows; verifier recall/precision/AUC are window-level metrics and are not interchangeable.

5.4. Software and Reproducibility

The synthetic and HRCA analyses used a Python 3.13 scientific-computing workflow centered on NumPy 2.5.3, SciPy 1.18.1, pandas 3.0.6, and scikit-learn 1.9.1 [37] with explicit random seeds. Summary statistics accompanying this revision are provided as machine-readable JSON alongside the resubmission package. Public HRCA data are CC BY 4.0. No new human subjects were enrolled. Primary synthetic uncertainty uses 20 hard-plant seeds; easy seed-7 remains the paper-matched reproduction baseline. HRCA uncertainty uses subject-grouped GroupShuffleSplit (n = 10).

6. Results

6.1. Synthetic Closed-Loop Versus Open-Loop Performance

On 280 held-out synthetic trials (seed = 7; easy/default plant—paper-matched reproduction baseline), the closed-loop controller achieved 100.0% Q1 force success, 0.0% miss rate, 0.0% false stimulation, ≈54.6 ms mean force latency, 0.116 ± 0.094 mean normalized elevation error, and 100.0% modeled airway-ok performance, with TinyML acc/f1/auc = 1.0. These saturated figures are implementation verification under the author-built easy plant, not clinical performance. Healthy vs. Parkinsonian seed-7 abstention (28.6% vs. 21.4%) is explained by confounder-specific rates (healthy confounder abstain = 1.000; PD confounder abstain = 0.750 with silent_reject = 0.250). The identical 3-decimal elev_err ≈ 0.116 across strata is an ILC residual aggregation coincidence (healthy − PD ≈ 1.3 × 10⁻⁴; unique trial errors), not cloned transcription.

Hard-plant multi-seed uncertainty (20 seeds). Mean ± 95% CI: closed-loop all Q1|detected = 0.963 ± 0.072, miss = 0.694 ± 0.035, false_stim = 0.216 ± 0.037, abstention = 0.720 ± 0.032, elev_err = 0.337 ± 0.021; unconditional Q1 ≈ 0.963 × (1 − 0.694) ≈ 0.295. Healthy: Q1|detected = 0.963 ± 0.069, elev_err = 0.196 ± 0.033; Parkinson: Q1|detected = 0.950 ± 0.098, elev_err = 0.478 ± 0.027; open-loop elev_err = 0.363 ± 0.025. TinyML held-out: acc = 0.948 ± 0.014, f1 = 0.957 ± 0.012, auc = 0.978 ± 0.008 (not saturated at 1.000). Relative to the Section 5.2 bars (Q1 ≥ 80%, miss ≤ 15%, false_stim ≤ 5%, elev_err ≤ 0.35), the hard-plant configuration fails miss and false_stim by a wide margin and sits near the elev_err bound; by the paper’s own criteria the harder plant renders this controller configuration infeasible. This is a candid stress-test negative result that marks an engineering feasibility boundary rather than a clinical claim.

Harder plant progression (seed = 7). Under the easy default plant, RF/TinyML test accuracy and closed-loop Q1 saturate (RF = 1.000, TinyML = 1.000, Q1 = 1.000, miss = 0.000, false_stim = 0.000). The first non-saturating configuration (hard_v1) yields RF = 0.990, TinyML = 0.970, Q1 = 1.000, miss = 0.230, false_stim = 0.512. Progressive hard_v2/v3 further increase class overlap and closed-loop miss. The easy plant remains the paper-matched reproduction baseline; the hard plant is an engineering stress test demonstrating that saturated verifier scores are plant-dependent rather than inevitable.

Elevation-error diagnosis. Seed = 7 stratum means are nearly equal (all = 0.1162, healthy = 0.1162, PD = 0.1161) but are an aggregation coincidence: n_unique trial errors = 200, and per-subject mean elevation error spans approximately [0.048, 0.250]. ILC dose adaptation drives both phenotypes toward a similar residual |z_peak − z_target|/z_target (healthy trials tend to slightly overshoot with lower adapted mA; PD trials tend to undershoot with higher mA), so absolute normalized magnitudes match even though kinematics and amplitudes differ. Across 20 hard-plant seeds, elev_err strata separate clearly (healthy ≈ 0.196 vs. Parkinson ≈ 0.478).

EMD/Te sensitivity. Hard plant with arming: for Te = 30–70 ms, Q1|detected remains 1.000 ± 0.000 while mean force latency shifts ≈1:1 with Te (−171.8 → −131.8 ms). Without arming, Q1 collapses (see ablation). Complementary easy-plant Te × Th grid: nominal (Te = 50 ms, Th = 390 ms) Q1 = 1.000; hard corner (Te = 150 ms, Th = 280 ms) Q1 = 0.000. Q1 is therefore a timing-margin metric under stated priors and, when reported beside miss rates, must be read as Q1|detected unless unconditional Q1 is explicitly stated.

H1 controller ablation on the hard plant (seeds (7, 11, 13, 17, 19)). reactive_only: Q1 = 0.591 ± 0.195 (healthy 0.506 ± 0.279; PD 0.762 ± 0.131), miss = 0.799 ± 0.111, false_stim = 0.150 ± 0.130. arming_no_emd and full: Q1 = 1.000 ± 0.000, miss = 0.630 ± 0.095, false_stim = 0.258 ± 0.128. Arming alone recovers the entire Q1 benefit (0.59 → 1.00); EMD compensation does not further improve Q1 on this plant and shifts mean force latency by only ≈3.8 ms (−138.4 → −142.2 ms) against a 50 ms EMD prior. Complementary easy-plant ablation: default EMD = 50 ms reactive Q1 = 0.814 vs. full = 1.000; stressed EMD = 80 ms reactive Q1 = 0.006 vs. full = 0.995.

Matched open-loop dosing preserved Q1 timing in the present synthetic configuration but produced materially larger elevation error (0.253 versus 0.116) and lower airway-ok performance (94.0% versus 100.0%). The comparison is therefore most informative for the adaptation loop rather than the timing loop: the synthetic result suggests that feedback-based dose adjustment improves elevation tracking without sacrificing the selected Q1 timing criterion. Table 2 reports the held-out synthetic closed-loop and open-loop results, and Table 3 summarizes TinyML verifier metrics against the feasibility criteria. Figure 16, Figure 17 and Figure 18 summarize control timing across experiment tracks, the seven-step stimulation timing flow, and synthetic feasibility under easy and hard plants.

Table 2. Held-out synthetic closed-loop and open-loop results.

Cohort	N	Timing and Error Metrics	Force Latency	Abstain/Feasible (Identical 0.116 Strata: See Section 6.1; ±0.094 Seed-7)
Test CL (all)	280	Q1 100%; miss 0%; false-stim 0%; elev. err. 0.116	54.6 ms	25.0%/Yes
Healthy CL	140	Q1 100%; miss 0%; false-stim 0%; elev. err. 0.116	49.3 ms	28.6%/Yes
Parkinson CL	140	Q1 100%; miss 0%; false-stim 0%; elev. err. 0.116	59.8 ms	21.4%/Yes
Open-loop	280	Q1 100%; miss 0%; false-stim 0%; elev. err. 0.253	53.9 ms	25.4%/Yes

Table 3. TinyML verifier and feasibility criteria.

Metric	Value
Hidden layers	[16, 8]
Approx. parameters	305
Test AUC/$F_1$/accuracy	1.000/1.000/1.000
Q1/miss/false-stim/elevation-error criteria	≥80%/≤15%/≤5%/≤0.35

Figure 16. Control timing across the four reported experiment tracks: synthetic closed-loop, synthetic open-loop, HRCA baseline, and HRCA improved. Synthetic panels show illustrative elevation with Q1 shading; HRCA panels use audit mean detect/force latencies (baseline ≈ 36.9/94.5 ms; improved ≈ −54.8/−35.1 ms).

Figure 17. Seven-step stimulation timing flow sheet: sensing, EEG arming, BI/sEMG gate, TinyML verification, EMD-compensated firing, assistive force, and feedback/ILC.

Figure 18. Synthetic feasibility (Round-2). (A) Easy seed-7 continuity vs. hard-plant 20-seed means: Q1|detected 1.000 vs. 0.963 ± 0.072, unconditional Q1 ≈0.295, miss 0 vs. 0.694 ± 0.035, false_stim 0 vs. 0.216 ± 0.037, elev_err 0.116 vs. 0.337 ± 0.021. (B) Hard-plant vs. Section 5.2 bars: miss and false_stim FAIL; elev_err borderline PASS; TinyML AUC 0.978 ± 0.008.

6.2. Public HRCA Performance

HRCA audit (N_subj = 12; 100 files; 148 swallows; front-end only—no BI/EEG/FES). Seed-7 timing (test): baseline detect = 0.9492, improved detect = 0.9831 (Δ = +3.39 pp); improved verifier recall = 0.4068, precision = 0.6154, AUC = 0.7424. Event-level detect can exceed window-level recall because the online detector scans a continuous rising-edge/dual-gate path. All HRCA tables, captions, and in-text values in this revision use these audit figures only; prior rounded percentage summaries are superseded and are not used.

Subject-grouped uncertainty. Repeated GroupShuffleSplit (n = 10), improved: AUC = 0.719 ± 0.030, F1 = 0.464 ± 0.041, recall = 0.432 ± 0.062, precision = 0.519 ± 0.047. Improved detect-latency histogram (n = 58): mean = −54.8 ms, median = −20.0 ms, p05 = −431.5, p95 = 304.5. Precision ≈ 0.52 still implies a substantial false-authorization burden at the selected operating point. Event-level confusion counts (seed-7 test; n_events = 59): baseline TP = 56/FN = 3; improved TP = 58/FN = 1. Window-level verifier confusion (improved): TN = 162, FP = 15, FN = 35, TP = 24.

Matching-window robustness (improved detector; test detect/Q1|detected/force latency vs. search half-width): ±0.25 s → 0.915/0.981/−6.9 ms; ±0.35 s → 1.000/0.932/−2.6 ms; ±0.45 s → 1.000/0.898/−26.3 ms; ±0.55 s → 1.000/0.898/−92.1 ms; ±0.70 s → 1.000/0.932/−210.5 ms. At the narrowest ±0.25 s half-width, detection falls while Q1|detected rises, consistent with retaining only nearer-onset matches; widening the window admits earlier candidates and deepens the negative mean force latency.

The improved pipeline produces negative mean detection and modeled force latencies relative to the VFSS onset label (test force latency −55.2 ms; subject-bootstrap mean −29.8 ms). These values reflect anticipatory rising-edge decisions intended to offset EMD, but the matching-window sweep shows that wider association windows also admit earlier candidates and can deepen negative means. They should not be interpreted as proof that a clinical wearable would always stimulate sufficiently early because the public HRCA corpus does not contain simultaneous BI, EEG, or final-electrode EMD measurements. Table 4 reports the public HRCA held-out results.

Table 4. Public HRCA held-out results.

Metric	Baseline	Improved	Δ
Detect rate	94.92%	98.31%	+3.39 pp
Force in Q1	59.2%	92.9%	+33.7 pp
Mean detect latency	55.8 ms	−75.5 ms	−131.3 ms
Mean force latency	113.0 ms	−54.6 ms	−167.6 ms
Verifier AUC	0.680	0.742	+0.062
Verifier $F_1$	0.489	0.490	+0.001
$\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}$	42.5%	61.5%	+19.0 pp
$\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}$	57.6%	40.7%	−16.9 pp

Event-level and window-level confusion counts from the HRCA audit (Table 5) (seed-7 test). Event detect: baseline TP = 56, FN = 3; improved TP = 58, FN = 1 (n_events = 59). Improved window verifier: TN = 162, FP = 15, FN = 35, TP = 24. Figure 19 and Figure 20 summarize the public HRCA audit comparison and the combined evidence dashboard.

Table 4. Public HRCA held-out results.

Metric	Baseline	Improved	Δ
Detect rate	94.92%	98.31%	+3.39 pp
Force in Q1	59.2%	92.9%	+33.7 pp
Mean detect latency	55.8 ms	−75.5 ms	−131.3 ms
Mean force latency	113.0 ms	−54.6 ms	−167.6 ms
Verifier AUC	0.680	0.742	+0.062
Verifier $F_1$	0.489	0.490	+0.001
$\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}$	42.5%	61.5%	+19.0 pp
$\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}$	57.6%	40.7%	−16.9 pp

Event-level and window-level confusion counts from the HRCA audit (Table 5) (seed-7 test). Event detect: baseline TP = 56, FN = 3; improved TP = 58, FN = 1 (n_events = 59). Improved window verifier: TN = 162, FP = 15, FN = 35, TP = 24. Figure 19 and Figure 20 summarize the public HRCA audit comparison and the combined evidence dashboard.

Table 5. HRCA audit confusion counts (seed-7 test; N_subj = 12 subset). Event-level detection and window-level verifier matrices.

Level	Count Type	Baseline	Improved
Event detect (n = 59)	TP/FN	56/3	58/1
Event detect	Detect rate	0.9492	0.9831
Window verifier	TN/FP	131/46	162/15
Window verifier	FN/TP	25/34	35/24
Window verifier	Precision/Recall/AUC	0.425/0.576/0.680	0.615/0.407/0.742

Table 5. HRCA audit confusion counts (seed-7 test; N_subj = 12 subset). Event-level detection and window-level verifier matrices.

Level	Count Type	Baseline	Improved
Event detect (n = 59)	TP/FN	56/3	58/1
Event detect	Detect rate	0.9492	0.9831
Window verifier	TN/FP	131/46	162/15
Window verifier	FN/TP	25/34	35/24
Window verifier	Precision/Recall/AUC	0.425/0.576/0.680	0.615/0.407/0.742

Figure 19. Public HRCA audit comparison (N_subj = 12; seed-7 test). (A) Event-level detect 0.9492 → 0.9831 (Δ = +3.39 pp); force-in-Q1 0.679 → 0.897. (B) Window verifier: AUC 0.6804 → 0.7424, precision 0.4250 → 0.6154, recall 0.5763 → 0.4068. Audit-harmonized metrics only.

Figure 19. Public HRCA audit comparison (N_subj = 12; seed-7 test). (A) Event-level detect 0.9492 → 0.9831 (Δ = +3.39 pp); force-in-Q1 0.679 → 0.897. (B) Window verifier: AUC 0.6804 → 0.7424, precision 0.4250 → 0.6154, recall 0.5763 → 0.4068. Audit-harmonized metrics only.

Figure 20. Combined evidence dashboard (Round-2). (A) Hard-plant feasibility vs. §5.2 with miss/false_stim FAIL (uncond. Q1 ≈ 0.295). (B) H1 ablation Q1: reactive ≈ 0.591 vs. arming_no_emd = full = 1.000. (C) HRCA audit detect 0.9492 → 0.9831 (+ 3.39 pp; N_subj = 12). (D) Improved verifier AUC/precision/recall = 0.7424/0.6154/0.4068.

Figure 20. Combined evidence dashboard (Round-2). (A) Hard-plant feasibility vs. §5.2 with miss/false_stim FAIL (uncond. Q1 ≈ 0.295). (B) H1 ablation Q1: reactive ≈ 0.591 vs. arming_no_emd = full = 1.000. (C) HRCA audit detect 0.9492 → 0.9831 (+ 3.39 pp; N_subj = 12). (D) Improved verifier AUC/precision/recall = 0.7424/0.6154/0.4068.

7. Assessment and Discussion

7.1. Assessment of the Hypotheses

H1 restatement (hard plant). The ablation shows reactive_only Q1 = 0.591 ± 0.195 versus arming_no_emd Q1 = 1.000 ± 0.000 and full Q1 = 1.000 ± 0.000. Arming is required to recover Q1; EMD compensation does not improve Q1 on the hard plant and shifts mean force latency by only ≈3.8 ms (−138.4 → −142.2 ms) against a 50 ms EMD prior. H1 is therefore restated: anticipatory arming is required for Q1; EMD compensation remains a latency-scheduling term whose Q1 benefit is not demonstrated under the hard plant. Easy-plant stressed-EMD ablation still collapses reactive Q1 (0.006) while full remains ≈0.995, indicating that EMD can matter under other priors. This is engineering evidence on an author-built model, not living-human closed-loop evaluation.

H2 is supported as an engineering property under the easy seed-7 plant (miss = 0, false_stim = 0 with confounder abstain = 0.875). Under the hard plant, 20-seed mean miss = 0.694 ± 0.035 and false_stim = 0.216 ± 0.037 breach the Section 5.2 feasibility bars (≤0.15 and ≤0.05), so H2 does not hold as a feasibility claim on the harder plant even though abstention remains active.

H3 must be assessed primarily on the hard plant now that it exists. Closed-loop elev_err = 0.337 ± 0.021 versus open-loop elev_err = 0.363 ± 0.025 is roughly a 7% reduction with substantially overlapping intervals. The easy seed-7 contrast (0.116 vs. 0.253, ≈54% reduction) remains an implementation-verification observation but is not carried as the primary H3 claim. ILC is directionally consistent with reduced error, but the hard-plant effect size is modest.

H4 is weakly supported by the public HRCA audit on the N_subj = 12 subset: improved seed-7 test detect 0.9492 → 0.9831 (Δ = +3.39 pp) with improved verifier AUC = 0.7424 and GroupShuffleSplit AUC = 0.719 ± 0.030. Larger previously rounded detection gains are superseded and are not used. The HRCA corpus lacks BI/EEG and cannot validate the complete SafeSwallow loop.

7.2. Engineering Significance

Hard-plant feasibility boundary (Section 7.2). Under the harder plant the configuration is infeasible by the paper’s own Section 5.2 criteria: miss = 0.694 ± 0.035 (bar ≤ 0.15) and false_stim = 0.216 ± 0.037 (bar ≤ 0.05) fail badly, while elev_err = 0.337 ± 0.021 sits near the ≤0.35 bound. Q1|detected = 0.963 ± 0.072 remains high among detections, but unconditional Q1 ≈ 0.295 makes clear that timely force on detections does not imply timely force on all swallows. A candid negative result under a self-imposed stress test is an intended engineering finding: it demarcates when the present verification–timing stack stops being feasible as noise and class overlap increase. Beyond that boundary finding, the main technical contribution is the integration of timing, verification, feedback, and safety into one causal control pipeline. Sensing is linked to a decision gate, timing compensation to EMD, stimulation to a measurable elevation response, and adaptation to non-learned safety logic, making failure modes visible and testable at the software level before clinical translation.

The compact form factor is also a system-level contribution. A behind-ear hub, around-ear EEG film, submental U-film, and laryngeal sensing stamp distribute functions according to their control role while avoiding a permanent forehead electrode in the preferred configuration. The architecture therefore addresses not only algorithmic closed-loop control but also the practical co-location of sensing, computation, stimulation, and user-accessible safety.

7.3. Limitations

Several limitations materially constrain interpretation. First, the synthetic plant is author-built; easy seed-7 saturation (AUC/F1/accuracy = 1.000) is implementation verification, while hard-plant TinyML AUC = 0.978 ± 0.008 still is not clinical generalization, and the hard plant itself fails the paper’s miss/false-stim feasibility bars. Second, HRCA is front-end only (N_subj = 12; no BI/EEG/FES), with a modest audit detection gain (+3.39 pp). Third, EMD remains an engineering prior: with arming, hard-plant Q1|detected stays 1.0 across Te = 30–70 ms but force latency tracks Te 1:1; without arming Q1 ≈ 0.59; easy Te × Th hard corner reaches Q1 = 0.000. Fourth, uncertainty is quantified (20 hard-plant seeds; HRCA GroupShuffleSplit n = 10), but clinical generalizability is not established. Fifth, elev_err ≈ 0.116 coincidence at easy seed-7 is explained; hard-plant strata separate (0.196 vs. 0.478). Sixth, detect vs. recall use different units; latency histograms show negative means with late tails. Seventh–ninth: inter-modal SNR characterization, online pathological personalization, and measured MCU/NPU latency/power budgets remain future work.

7.4. Relation to Prior Art and Novelty Framing

Relative to the state of the art, SafeSwallow is differentiated by the combination of ear/glasses EEG arming without relying on EEG as the sole fire authority; BI and sEMG gating; TinyML/RF swallow verification; explicit EMD/Q1-referenced scheduling; elevation-feedback ILC dose adaptation; and a deterministic Tier-0 safety layer incorporating current/charge limits, refractory timing, watchdogs, impedance inhibition, abstention, and a user kill-switch [38]. Charge-density safety accounting should also be interpreted in light of tissue-damage threshold literature [36]. The contribution is framed as systems-level integration and control architecture rather than claiming that individual sensing modalities or stimulation methods are themselves new.

Equations (16)–(20) formalize the timing budget. The quarter-window construction is derived from the stated engineering prior for the elevation ramp; it is not a new physiological law. The decomposition of T_p into filtering, feature extraction, inference, and scheduling terms is a causal latency accounting model. The force-arrival relation uses the actuator-delay prior T_e. This is consistent with the literature showing that laryngeal elevation can be actively augmented and that stimulation must be temporally coordinated with swallowing [12,13].

8. Future Work

The next stage is hardware and clinical translation. First, prototype the preferred patch/hub and measure electrode-specific EMD, charge density, current limits, and skin-safety margins on a named MCU/NPU with latency/power budgets. Second, collect paired BI–sEMG–accelerometry–microphone–EEG with VFSS/FEES ground truth. Third, evaluate the full HRCA corpus beyond N_subj = 12. Fourth, human-factors and deployment studies. Fifth, prospective clinical safety-then-efficacy studies. Esophageal modes remain out of scope.

9. Conclusions

SafeSwallow is a compact wearable neuroprosthesis architecture for oropharyngeal dysphagia assistance that combines multimodal oropharyngeal sensing, anticipatory arming, causal swallow verification, explicit EMD scheduling, FES for hyolaryngeal/pharyngeal assistance, post-action elevation estimation, and across-swallow ILC under a deterministic Tier-0 safety supervisor; esophageal dysphagia is out of scope. Synthetic experiments provide implementation verification and timing-margin analysis: easy seed-7 is paper-matched (Q1 = 1.0; elev_err = 0.116 ± 0.094); across 20 hard-plant seeds, TinyML AUC = 0.978 ± 0.008 and Q1|detected = 0.963 ± 0.072, but miss = 0.694 ± 0.035 and false_stim = 0.216 ± 0.037 render the configuration infeasible by the paper’s own criteria (unconditional Q1 ≈ 0.295). H1 ablation shows arming is required for Q1 (reactive ≈ 0.59 vs. arming/full = 1.0) while EMD adds only ≈3.8 ms latency shift without a Q1 gain on the hard plant. H3 on the hard plant is a modest elev_err reduction (0.337 ± 0.021 CL vs. 0.363 ± 0.025 OL). On public HRCA (N_subj = 12), improved detect 0.949 → 0.983 (Δ = +3.39 pp) with verifier AUC = 0.7424. The evidence supports engineering plausibility within stated bounds and candidly reports the hard-plant feasibility boundary. Clinical translation requires paired multimodal data, measured EMD, validated stimulation safety, deposited code/data, and prospective human studies.

10. Expanded Control-Theoretic Formulation

This section develops the controller beyond the compact formulation in Section 3. The purpose is not to introduce new experimental evidence, but to make explicit the mathematical assumptions, timing variables, estimator structure, safety constraints, and adaptation laws that are implicit in the implemented SafeSwallow architecture. The resulting formulation is suitable for independent implementation and for subsequent replacement of engineering priors by subject-specific measurements.

10.1. Timing Geometry and Causal Feasibility;

Let $t_0$ denote the VFSS-referenced pharyngeal onset, and let Telev denote the duration of the principal hyolaryngeal elevation ramp. The first-quarter interval is used as an engineering target because assistance arriving after a substantial fraction of the elevation trajectory has elapsed provides progressively less opportunity to influence early airway protection. The Q1 criterion is deliberately conservative and is not asserted to be a universal clinical boundary.

Equations (21)–(23) describe a multimodal observation model. The vector y_k collects heterogeneous causal measurements; the map Φ converts the most recent W samples into features; and f_θ maps those features to swallow probability. The formulation is intentionally sensor-fusion rather than sensor-substitution: no single channel is declared ground truth. This approach is aligned with the BI/EMG swallow-onset methodology reported by Riebold et al. [10] and with HRCA work showing that microphone and accelerometer features can support machine-learning swallow identification [26,27].

$$T_q={\displaystyle \frac{T_h}{4}}$$

(16)

where $T_q$ is the duration of the first-quarter target interval, and $T_h$ is the elevation-ramp duration.

$$t_q=t_0+T_q$$

(17)

where $t_q$ is the absolute Q1 deadline, and $t_0$ is pharyngeal onset.

$$T_p=T_f+T_x+T_i+T_s$$

(18)

where $T_p$ is the causal electronic decision-path delay; $T_f$, $T_x$, $T_i$, and $T_s$ denote filtering, feature extraction, inference, and scheduling delays, respectively.

$$t_a=t_r+T_p+T_e$$

(19)

where $t_a$ is the expected onset of useful mechanical force, $t_r$ is the effective decision origin, and $T_e$ is the stimulation-to-force electromechanical delay.

$$M_q=t_q-t_a$$

(20)

where $M_q$ is the timing margin. Positive values indicate modeled force arrival before the $Q_1$ deadline; negative values indicate a timing miss.

Equations (24)–(26) separate the learned authorization gate from deterministic safety conditions. The gate a(t) is a logical AND of necessary conditions, so any unsafe state forces abstention. This structure is a control-design choice of the SafeSwallow architecture, while the specific charge/current and watchdog implementation must ultimately be verified against the final hardware and applicable safety standards. IEC 60601-2-10 is the relevant particular standard for nerve and muscle stimulators [35].

Equation (20) makes the reason for anticipatory arming transparent. If the sum of causal processing delay and EMD approaches the available Q1 interval, a purely reactive controller has little robustness to delayed physiology, computational jitter, or conservative verification. SafeSwallow therefore separates arming from firing. EEG and early peripheral features may prepare the high-voltage rail and compute a provisional schedule, but stimulation remains contingent on the independent peripheral and safety gates. Table 6 lists the timing variables and engineering priors used in the reported experiments.

Table 6. Timing variables and engineering priors used in the reported experiments.

Symbol	Meaning	Reported Prior/Role
Th	Hyolaryngeal elevation-ramp duration	0.390 s mean prior
T_q	First-quarter target interval	0.0975 s for $T_h$ = 0.390 s
T_f	Causal filtering contribution	approximately 0.030 s within detection path
T_d	Peripheral detection path	approximately 0.033 s
T_c	Residual compute delay	approximately 0.008 ± 0.003 s in simulation
T_e	Electrical-to-mechanical delay	0.050 s engineering prior
T_r	Post-stimulation refractory interval	approximately 1.0 s
T_b	FES burst duration	approximately 0.60 s
T_g	Stimulation ramp	approximately 0.04 s

10.2. Multimodal Observation Model

The wearable does not treat any single sensor as ground truth. Instead, each modality contributes a partial observation of a latent swallow state. EEG contributes anticipatory intent, sEMG contributes elevator recruitment, BI contributes onset and elevation geometry, and the microphone/IMU pair contributes vibration and kinematic corroboration. This division of labor is central to the architecture because the modalities have different latency, specificity, and artifact profiles.

$${\mathbf{y}}_k={\left[E_k,M_k,B_k,C_k,I_k\right]}^T$$

(21)

where ${\mathbf{y}}_k$ is the multimodal observation vector at sample k; each component is the causal measurement or derived feature stream from one sensing modality.

$${\mathbf{x}}_k=\Phi \left(Y_k\right)$$

(22)

where $x_k$ is the causal feature vector, and $\Phi \left(\cdot \right)$ is the deterministic feature map applied only to the most recent W samples; no future samples are used.

Equations (27)–(33) provide a standard state-estimation model followed by an across-swallow adaptation law. The state-space and Kalman update are derived from classical stochastic filtering [34]. The ILC update is based on the repetitive-process learning framework summarized by Bristow et al. [31]. The optional rate limiter is introduced here as an engineering safeguard to prevent abrupt changes in stimulation amplitude between swallows; it is not derived from a universal physiological constant.

$${\mathbf{x}}_k=\Phi \left(Y_k\right)$$

(23)

where $p_s\left(t\right)$ is the calibrated probability of a true swallow, and $f_{\theta }$ is the trained RF, MLP, or ensemble verifier.

$$v\left(k\right)=\mathbf{1} \left\{p_s\left(k\right)\ge {\tau }^{\mathrm{*}}\right\}$$

(24)

where $v\left(k\right)$ is the binary verification gate, and ${\tau }^{\mathrm{*}}$ is selected on training folds rather than on the held-out test set.

The causal-window requirement is important. Offline zero-phase filtering or symmetric smoothing can make a detector appear earlier than a realizable embedded implementation. All reported timing interpretations therefore assume causal processing. The HRCA negative latencies arise from early signal structure relative to the VFSS-labeled reference frame and from anticipatory scheduling, not from non-causal access to future data.

10.3. Safety-Constrained Fire Logic

$$s=g_{Z}w\left(1-h\right)\left(1-r\right)g_Q$$

(25)

where $g_Z$ indicates acceptable electrode impedance, $w$ indicates a healthy watchdog, $h$ is the user OFF state, $r$ is refractory lockout, and $g_Q$ indicates that current/charge constraints are satisfied.

$$f=cbmvs$$

(26)

where $f$ is the final authorization gate. Every factor must be true before stimulation energy can be delivered.

$$u_c=f\hspace{0.17em}\mathrm{s}\mathrm{a}\mathrm{t} \left(u^{\mathrm{*}};u_l,u_h\right)$$

(27)

where $u_c$ is commanded dose, $u^{\mathrm{*}}$ is the adaptive requested dose, and sat(·) enforces hard hardware limits.

$$Q_p=I_p{\tau }_p$$

(28)

where $Q_p$ is charge delivered in one stimulation phase, $I_p$ is phase current, and ${\tau }_p$ is phase width.

$${\rho }_Q={\displaystyle \frac{Q_p}{A_e}}\le {\rho }_q$$

(29)

where ${\rho }_Q$ is charge density, $A_e$ is effective electrode area, and ${\rho }_q$ is the hardware/clinical safety ceiling to be finalized for the physical electrode.

The logical structure in (24)–(26) intentionally places learned components below deterministic interlocks. A classifier may withhold stimulation but cannot raise current limits, bypass a fault, shorten refractory lockout, or override the tactile kill-switch. This separation is a design principle rather than a claim of completed regulatory verification.

10.4. Elevation Observer and Adaptive Dose Law

Equation Provenance, Assumptions, and Limits of Interpretation

The expanded equations in this section make explicit relationships that were only implicit in the compact controller description. They should be read as engineering models used for simulation and implementation planning, not as experimentally identified physiological laws. Each relationship therefore has a clearly stated provenance or assumption.

The adaptation loop operates across swallows rather than attempting unconstrained high-bandwidth correction during a single swallow. This choice matches the repetitive nature of meal-time swallowing and avoids allowing a learned controller to chase noisy within-swallow measurements. BI is the principal elevation proxy in the proposed embodiment, with microphone and IMU features available to improve observability.

$${\mathbf{x}}_{k+1}=A{\mathbf{x}}_k+B{u}_k+{\mathbf{w}}_k$$

(30)

where $x_k$ is a latent state containing elevation and slowly varying fatigue terms; $u_k$ is stimulation dose; $w_k$ is process disturbance.

Equations (34)–(37) define the deterministic feature layer. The RMS expression is the standard discrete-time energy-envelope estimator; the BI-difference and slope features are causal local descriptors; and z-score normalization uses training/calibration statistics so that the held-out test set is not used to define scaling parameters. These choices are implementation methods, not claims of physiological uniqueness. The literature supports BI/EMG fusion for swallow-onset detection [10].

$${\mathbf{y}}_k=C{\mathbf{x}}_k+{\mathbf{v}}_k$$

(31)

where ${\mathbf{y}}_k$ contains BI-derived elevation and optional acoustic/IMU features; $v_k$ is measurement noise.

$${x\_p}_k=A{x\_f}_{k-1}+B{u}_{k-1}$$

(32)

where ${x\_p}_k$ is the one-step predicted state estimate.

$$K_k=P_k^{-}{C}^T {\left(C{P}_k^{-}{C}^T+R\right)}^{-1}$$

(33)

where $K_k$ is the Kalman gain, $P_k^{-}$ is predicted covariance, and R is measurement-noise covariance.

$${x\_f}_k={x\_p}_k+K_k \left({\mathbf{y}}_k-C{x\_p}_k\right)$$

(34)

where ${x\_f}_k$ is the corrected state estimate, and the parenthetical term is the innovation.

$$e_n=z_n^{\mathrm{*}}-{\widehat{z}}_n$$

(35)

where $e_n$ is the elevation error for swallow n, $z_k^{\mathrm{*}}$ is the desired elevation target, and ${\widehat{z}}_n$ is observed elevation.

Equations (38)–(41) formalize the classifier objective and operating-point selection. Binary cross-entropy corresponds to the negative log-likelihood of a Bernoulli model [32]. The F1 definition follows the standard precision/recall framework [33]. The threshold is deliberately selected from grouped training/validation data to prevent information leakage into the held-out evaluation.

$$u_{n+1}=\mathrm{s}\mathrm{a}\mathrm{t} \left(u_n+L{e}_n;\hspace{0.17em}{u}_l,u_h\right)$$

(36)

where $u_{n+1}$ is the next-swallow dose, and L is the ILC learning gain.

$$\Delta u_n=\mathrm{c}\mathrm{l}\mathrm{i}\mathrm{p} \left(L{e}_n;\hspace{0.17em}-\Delta u_h,+\Delta u_h\right)$$

(37)

where $\Delta u_n$ is an optional rate-limited dose increment; $\Delta u_h$ prevents abrupt swallow-to-swallow changes.

For a locally linear static approximation $z\approx Gu$, the scalar ILC error dynamics become $e_{n+1}\approx \left(1-GL\right)e_n$. A sufficient local monotonicity condition is $\left|1-GL\right|<1$ over the plausible gain range. In the present study, this relation is used as engineering intuition; the reported results arise from the simulation implementation and not from a formal proof of stability for human physiology.

11. Detailed Algorithm Description and Training Pipeline

11.1. Algorithmic Decomposition

The software is decomposed into seven modules so that sensing, learned inference, scheduling, adaptation, and safety can be tested independently. This modularity is especially important for a medical controller because a performance improvement in the verifier must not silently alter the stimulation envelope. Table 7 states the input–output contract of each module.

Table 7. Software modules, inputs, outputs, and failure behavior.

Module	Primary Input	Output	Failure Behavior
A0 safety supervisor	kill, impedance, watchdog, charge, refractory	allow/inhibit, HV state	latched inhibit/zero current
A1 feature front-end	EEG, sEMG, BI, mic, IMU	causal feature vector	mark invalid/abstain
A2 intent arming	EEG + early peripheral features	time-to-onset, confidence, arm	no arm if confidence low
A3 swallow verifier	causal feature vector	psw, $v$	abstain below threshold
A4 fire scheduler	gates + timing model	$t_f$, burst command	no fire if any gate fails
A5 observer + ILC	post-action BI/mic/IMU	${\widehat{z}}_k$, next dose	retain/conservatively bound dose
A6 HRCA front-end	mic + tri-axial acceleration	detect, verifier score, modeled timing	evaluation only; no physical stimulation

Equations (42)–(43) describe anticipatory onset prediction. The Huber loss is used because it is quadratic for small errors and linear for large errors, reducing sensitivity to outlying onset-time errors; this robust-loss concept originates with Huber [39]. The additional false-arm penalty is specific to SafeSwallow because an early prediction is useful only when it does not create unnecessary pre-charge or stimulation opportunities.

11.2. Feature Engineering

The deterministic front-end converts heterogeneous sensor streams into a compact vector suitable for embedded inference. For sEMG, the principal quantity is a causal RMS envelope after band-limited conditioning. For BI, the features include deviation from a slowly varying baseline and local slope. Microphone and accelerometer channels contribute multi-band energy, envelope, spectral moments, and superior–inferior (SI) motion proxies. EEG contributes intent-related features and an estimated time to onset when available. Features are normalized using statistics estimated from training/calibration data only.

$$r_m\left(k\right)=\sqrt{{\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=0}^{N-1}}{s}_m^2\left(k-i\right)}$$

(38)

where $r_m\left(k\right)$ is the causal N-sample root-mean-square envelope of the conditioned sEMG signal.

$$\Delta Z\left(k\right)=Z_0\left(k\right)-Z\left(k\right)$$

(39)

where $\Delta Z\left(k\right)$ is the BI drop relative to the slow causal baseline $Z_0$.

$$s_Z\left(k\right)={\displaystyle \frac{Z\left(k\right)-Z\left(k-m\right)}{m\hspace{0.17em}\Delta t}}$$

(40)

where $s_Z\left(k\right)$ is an m-sample causal BI slope estimate, and $\Delta t$ is the sample period.

$${\tilde{x}}_j={\displaystyle \frac{x_j-{\mu }_j}{{\sigma }_j+\epsilon }}$$

(41)

where ${\tilde{x}}_j$ is normalized feature j; ${\mu }_j$ and ${\sigma }_j$ are training/calibration statistics; and $\epsilon$ prevents division by zero.

11.3. Swallow Verifier Training

The synthetic verifier was trained using subject-grouped data so that windows from a held-out subject did not leak into training. Eight training subjects contributed 20 swallow events and 12 confounders per subject. Four unseen subjects were reserved for held-out classifier metrics, and the subsequent closed-loop/open-loop evaluation used eight additional unseen subjects. The classifier therefore encountered new simulated subjects during final control evaluation. The compact MLP used two hidden layers of 16 and eight units, approximately 305 trainable parameters for the nine-feature implementation reported here.

The selected MLP formulation is consistent with standard supervised probabilistic classification practice [32]. The manuscript reports the architecture and split explicitly so that the engineering result can be reproduced without implying that the model is clinically validated.

The experimental-model equations following this section should be interpreted with the same discipline: whenever a parameter is borrowed from literature it is marked as an engineering prior; whenever a parameter is selected by the present study it is described as a design choice; and whenever an equation represents an implementation convenience rather than a validated physiological law, that distinction is made explicitly. This prevents the mathematical model from being mistaken for clinical ground truth.

$$J_b=-\sum _i\left[y_i\mathrm{l}\mathrm{n}{p}_i+\left(1-y_i\right)\mathrm{l}\mathrm{n}\left(1-p_i\right)\right]$$

(42)

where $J_b$ is binary cross-entropy, $y_i$ is the true class, and $p_i$ = $f_{\theta }$($x_i$) is the predicted swallow probability.

$$\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}={\displaystyle \frac{\mathrm{T}\mathrm{P}}{\mathrm{T}\mathrm{P}+\mathrm{F}\mathrm{P}}}, \mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}={\displaystyle \frac{\mathrm{T}\mathrm{P}}{\mathrm{T}\mathrm{P}+\mathrm{F}\mathrm{N}}}$$

(43)

where $\mathrm{T}\mathrm{P}$, $\mathrm{F}\mathrm{P}$, and $\mathrm{F}\mathrm{N}$ denote true-positive, false-positive, and false-negative counts.

$$F_1={\displaystyle \frac{2\hspace{0.17em}\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}\hspace{0.17em}\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}}{\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}+\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}}}$$

(44)

where $F_1$ is the harmonic mean used to choose the operating point under class imbalance.

$${\tau }^{\mathrm{*}}=\underset{\tau }{\mathrm{a}\mathrm{r}\mathrm{g} \mathrm{m}\mathrm{a}\mathrm{x}}{F}_t\left(\tau \right)$$

(45)

where ${\tau }^{\mathrm{*}}$ is chosen exclusively on training/validation folds and then frozen for held-out evaluation.

Probability calibration is desirable because the verifier output is used as a safety gate rather than merely a ranking score. In the reported engineering implementation, the minimum fire-authorization probability was 0.55. This value should be regarded as an engineering prior, not a clinically validated threshold. Future clinical work should select operating points from prospectively defined risk functions that penalize false stimulation more strongly than ordinary classification error.

11.4. Anticipatory Model Training

The anticipatory model is conceptually distinct from the verifier. Its task is to estimate whether a swallow is approaching and, when possible, predict the remaining time to onset. It is intentionally prevented from sole-firing the stimulator. Candidate causal sequence models include a temporal convolutional network (TCN) or gated recurrent unit (GRU). Training targets are onset-relative times derived from synchronized annotations. False early arms are explicitly penalized because unnecessary pre-charge increases power consumption and can reduce the interpretability of the timing path.

The anticipatory predictor is a feedforward timing aid, not the final classifier. The distinction prevents the system from conflating “likely to swallow soon” with “authorized to stimulate.”

$$J_o={\displaystyle \frac{1}{M}}{\displaystyle \sum _{j=1}^M}{H}_{\delta } \left(o_j-o_j\right)$$

(46)

where $J_o$ is the robust onset-regression loss, $o_j$ is predicted onset, $o_j$ is reference onset, and $\delta$ is the Huber transition parameter.

$$J_a=J_o+{\lambda }_f{\displaystyle \frac{N_a}{M}}$$

(47)

where $J_a$ augments timing error with a penalty on false anticipatory arms; ${\lambda }_f$ controls the penalty weight.

11.5. Reproducible Reference Pseudocode

Listings 1–3 provide implementation-oriented reference pseudocode. Listing 1 gives the reference real-time control logic; Listing 2 gives the reference training and operating-point selection pipeline; and Listing 3 gives the safety-bounded swallow-to-swallow ILC update. Listings are numbered continuously and are retained as listings (not Algorithm environments).

Listing 1. Reference real-time control logic (implementation-oriented pseudocode).

# Algorithm 1: real-time SafeSwallow control cycle for each sample k: safety = tier0_check(kill, impedance, watchdog, refractory, charge) if not safety.allow: stimulator.off(); continue x = causal_features(EEG, sEMG, BI, MIC, IMU) arm, dt_hat = intent_model(x.eeg, x.early_peripheral) g_bi = (x.delta_Z >= θps) g_emg = (x.rms_emg >= theta_emg) psw = verifier.predict_proba(x) g_ai = (psw >= tau_star) if arm and g_bi and g_emg and g_ai: t_f = now + T_c − Te schedule_charge_balanced_FES(t_f, dose=u) refractory.start() else: abstain() if stimulation_completed: z_hat = elevation_observer(BI, MIC, IMU) error = z_target − z_hat u = saturate(u + L*error, u_l, u_h)

Listing 2. Reference training and operating-point selection pipeline.

# Algorithm 2: subject-grouped verifier training subjects = split_by_subject(dataset, seed=7) train, validation, test = grouped_partition(subjects) mu, sigma = fit_normalizer(train.features) Xtr = normalize(train.features, mu, sigma) Xva = normalize(validation.features, mu, sigma) model = TinyML_MLP(input_dim=9, hidden=[16, 8], output=1) for epoch in range(max_epochs): p = model(Xtr) loss = binary_cross_entropy(p, train.labels) optimizer.step(loss) if early_stop(validation_loss): break # threshold is selected without looking at held-out test labels p_val = model(Xva) tau_star = argmax_F1(p_val, validation.labels) freeze(model, tau_star, mu, sigma) report_oce_on_held_out_test()

Listing 3. Safety-bounded swallow-to-swallow ILC update.

# Algorithm 3: ILC update with deterministic bounds def update_dose(u, z_target, z_hat, L, u_l, u_h, du_h): e = z_target − z_hat du = clip(L*e, -du_h, +du_h) u_next = clip(u + du, u_l, u_h) return u_next, e

12. Expanded Experimental Design and Reproducibility

12.1. Synthetic Experiment as a Controlled Ablation Environment

The synthetic experiment should be interpreted as a controlled engineering stress test rather than a clinical trial. Its value is that timing, fatigue, noise, confounders, medication-state scaling, and controller components can be changed independently while preserving ground truth. This allows direct comparison of fixed-dose and adaptive control under matched latent physiology. The principal risk is model optimism: if the synthetic class distributions are too separable, classifier metrics can saturate, as occurred for the compact verifier. Consequently, the synthetic results support implementation feasibility but do not establish clinical sensitivity or specificity. Table 8 lists the synthetic experiment factors and their purpose.

Table 8. Synthetic experiment factors and their purpose.

Factor	Implementation in Reported Study	Purpose
Sampling	1 kHz simulated multimodal streams	resolve millisecond-scale timing
Healthy phenotype	~12 ± 1.2 mm peak elevation; ~0.39 ± 0.03 s duration	nominal control condition
Parkinsonian phenotype	reduced gain, delayed onset, prolonged elevation, faster fatigue	stress delayed/bradykinetic behavior
Medication state	ON/OFF scaling pattern	introduce within-phenotype variability
Confounders	speech/chew/cough-like events	test false-stimulation rejection
EMD	50 ms engineering prior	force-arrival timing model
Compute jitter	~8 ± 3 ms	edge inference variability
Dose bounds	4–25 mA; nominal 12 mA	constrain adaptation
Refractory	1.0 s	prevent rapid retriggering

12.2. Cohort Construction and Data Separation

The training, classifier-test, and controller-test populations were separated by subject identifiers. The final controller experiment used eight unseen subjects, four healthy and four Parkinsonian, with 25 swallows and 10 confounders per subject. This yielded 280 trials for closed-loop evaluation and a matched 280-trial open-loop comparison. The use of matched subject/event counts reduces variance when comparing elevation error, although the simulation remains dependent on the assumed plant distribution. Table 9 summarizes the data partitioning used in the synthetic track.

Table 9. Data partitioning used in the synthetic track.

Partition	Subjects	Events per Subject	Role
Verifier training	8	20 swallows + 12 confounders	fit classifier parameters
Held-out classifier set	4 unseen	15 swallows + 10 confounders	classifier metrics
Closed-loop control test	8 unseen	25 swallows + 10 confounders	final adaptive-control evaluation
Open-loop control test	same 8 unseen	matched event counts	fixed-dose comparator

12.3. HRCA Public-Data Experiment

The second evidence track deliberately replaces synthetic acoustic/kinematic channels with real recordings. The public HRCA corpus provides a contact microphone and tri-axial accelerometry synchronized to VFSS-derived swallow annotations. Because it lacks BI and EEG, it cannot instantiate the complete SafeSwallow loop. Its role is narrower and important: it tests whether a causal wearable-compatible front-end can improve event detection and modeled timing under real physiological and acquisition noise.

• where $n_s$ is the audio/accelerometer sample corresponding to VFSS frame $n_f$; $f_s$ = 4000 Hz, and $f_v$ = 60 frames/s in the reported conversion.

The baseline and improved methods use identical group-aware partitions. The improved method adds multi-band causal envelopes, soft-threshold denoising as an SNR proxy, a superior–inferior displacement proxy, tri-axial consensus, a class-balanced RF+MLP ensemble, an $F_1$-selected threshold, acoustic corroboration, and an anticipatory rising-edge rule. The comparison therefore evaluates a pipeline change rather than a change in test data.

12.4. Metrics and Statistical Interpretation

$$R_d={\displaystyle \frac{N_d}{N_s}}$$

(48)

where $R_d$ is swallow detection rate on labeled swallows.

$$R_q={\displaystyle \frac{N \left(t_a\le t_q\right)}{N_s}}$$

(49)

where $R_q$ is the modeled fraction of true swallows for which useful force is predicted to arrive by the $Q_1$ deadline.

$$R_f={\displaystyle \frac{N_f}{N_c}}$$

(50)

where $R_f$ is the false-stimulation rate over non-swallow confounders.

$$E_e={\displaystyle \frac{1}{N}}{\displaystyle \sum _{n=1}^N}{\displaystyle \frac{\left|z_n^{\mathrm{*}}-{\widehat{z}}_n\right|}{z_s}}$$

(51)

where $E_e$ is mean normalized elevation error; $z_s$ is the normalization scale used by the simulation.

These metrics should not be conflated. Detection rate describes sensing performance, whereas Q1 success additionally incorporates the timing model and EMD. Elevation error measures the dose-control objective. A system can therefore detect every swallow yet still fail the timing requirement, or meet timing while delivering a poorly matched dose. The architecture is intentionally evaluated along all three axes.

13. Expanded Results and Engineering Interpretation

This section expands the engineering interpretation of Section 6 with additional tabulated detail; unique equations and tables are retained in the main text.

13.1. Synthetic Closed-Loop Performance

The held-out synthetic closed-loop experiment (seed = 7; easy plant) met all prespecified engineering feasibility bars: Q1 = 100.0%, miss = 0.0%, false stimulation = 0.0%, mean force latency ≈ 54.6 ms, elev_err = 0.116 ± 0.094. Across 20 hard-plant seeds, Q1|detected = 0.963 ± 0.072, unconditional Q1 ≈ 0.295, miss = 0.694 ± 0.035, false_stim = 0.216 ± 0.037, elev_err = 0.337 ± 0.021. By the paper’s own criteria the hard-plant configuration is infeasible (miss and false_stim bars breached). These numbers demonstrate timing-policy margin among detections under assumed plants; they do not demonstrate that human patients will exhibit the same timing or separability.

On the easy plant, open-loop dosing produced mean normalized elevation error 0.253 versus 0.116 for closed-loop control. On the hard plant—the primary H3 assessment—the corresponding comparison is 0.363 ± 0.025 open-loop versus 0.337 ± 0.021 closed-loop (≈7% relative reduction with overlapping intervals). Timing determines when assistance arrives; feedback adaptation determines how much assistance is requested on subsequent swallows.

$$\Delta E_r={\displaystyle \frac{E_o-E_c}{E_o}}\times 100\%$$

(52)

where $\Delta E_r$ is the relative reduction in normalized elevation error; $E_o$ and $E_c$ are open-loop and closed-loop errors.

$\Delta E_r$ in prose (numbered equation omitted as trivial arithmetic): relative reduction ≈ (0.253 − 0.116)/0.253 = 54.2%. This is engineering evidence that adaptation is active in the model, not a clinical effect size. Table 10 interprets the synthetic results.

Table 10. Interpretation of the synthetic results.

Observation	Numerical Result	Engineering Interpretation	Caution
Q1 success	100.0%	timing policy satisfies modeled deadline	depends on assumed EMD and plant
False stimulation	0.0%	multigate logic rejects simulated confounders	synthetic confounders may be easier than real artifacts
Elevation error	0.116 CL vs. 0.253 OL	feedback/ILC improves dose matching	not a clinical swallowing score
Healthy force latency	49.3 ms	substantial modeled Q1 margin	simulation only
Parkinson force latency	59.8 ms	delayed phenotype remains feasible	phenotype is literature-inspired, not patient-specific

13.2. HRCA Real-Signal Performance

On held-out HRCA swallows (N_subj = 12 audit), seed-7 test detect rose from 0.9492 to 0.9831 (Δ = +3.39 pp). Improved verifier recall/precision/AUC = 0.4068/0.6154/0.7424. GroupShuffleSplit (n = 10) improved AUC = 0.719 ± 0.030. Prior rounded percentage summaries are superseded.

$$\Delta R_d=94.9\%-83.1\%=11.8\hspace{0.17em}\mathrm{p}\mathrm{p}$$

(53)

$\Delta R_d$ where Δ_detect is the absolute detection improvement from the audit raw rates: 0.9831 − 0.9492 = 0.0339 (3.39 percentage points).

$$\Delta R_q=92.9\%-59.2\%=33.7\hspace{0.17em}\mathrm{p}\mathrm{p}$$

(54)

where $\Delta R_q$ is the absolute improvement in modeled $Q_1$ force success.

The improved verifier AUC is 0.7424, with precision 0.6154 and recall 0.4068 on the audit seed-7 window evaluation (baseline window AUC 0.6804, precision 0.4250, recall 0.5763). These audit values are the sole HRCA performance figures used in this article.

Improved detect-latency histogram (n = 58): mean = −54.8 ms, median = −20.0 ms, p05 = −431.5, p95 = 304.5. A negative mean is compatible with a late positive tail. Negative values are anticipatory relative to VFSS-labeled onset, not evidence that the full physiological swallow was known a priori. HRCA remains front-end only. Table 11 emphasizes interpretation of the HRCA results.

Table 11. HRCA results with interpretive emphasis.

Metric	Baseline	Improved	Interpretation
Detect rate	94.92%	98.31%	+3.39 pp
Modeled Q1 success	59.2%	92.9%	large timing benefit from anticipatory/scheduling changes
Mean detect latency	55.8 ms	−75.5 ms	early decision relative to VFSS reference
Mean force latency	113.0 ms	−54.6 ms	EMD-compensated modeled force becomes anticipatory
AUC	0.680	0.742	+0.062
$F_1$	0.489	0.490	+0.001
$\mathrm{P}\mathrm{r}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}$	42.5%	61.5%	+19.0 pp
$\mathrm{R}\mathrm{e}\mathrm{c}\mathrm{a}\mathrm{l}\mathrm{l}$	57.6%	40.7%	−16.9 pp

13.3. Hypothesis-by-Hypothesis Assessment

Table 12 summarizes the four predefined engineering hypotheses against the evidence reported in this study.

Table 12. Assessment of the four predefined engineering hypotheses.

Hypothesis	Evidence in This Study	Assessment
H1: anticipatory arming required for Q1; EMD is latency term	hard-plant ablation: reactive Q1 ≈ 0.59; arming_no_emd = full = 1.0; EMD latency shift ≈3.8 ms only	partially supported (arming yes; EMD–Q1 no on hard plant)
H2: multimodal verification + abstention limits false stimulation	easy seed-7 false_stim = 0; hard plant false_stim = 0.216 ± 0.037 and miss = 0.694 ± 0.035 (infeasible vs. ≤5%/≤15% bars)	supported on easy plant; fails feasibility on hard plant
H3: ILC reduces elevation error	hard plant: elev_err 0.337 ± 0.021 CL vs. 0.363 ± 0.025 OL (~7%, overlapping CIs); easy 0.116 vs. 0.253 is verification only	weakly supported on hard plant; easy effect not primary
H4: richer causal HRCA front-end improves detection/Q1 proxy	audit detect 0.9492 → 0.9831 (Δ = +3.39 pp); AUC 0.7424; N_subj = 12	weakly supported; +3.4 pp not +3.39 pp

14. System Implementation, Failure Modes, and Deferred Computational Budget

14.1. Embedded Execution Model

The intended embedded implementation separates the hard real-time path from non-real-time clinician analytics. The behind-ear hub performs causal filtering, feature extraction, inference, scheduling, stimulation control, and Tier-0 safety locally. A phone or clinic application may receive logs, calibration summaries, and longitudinal statistics, but is not required for millisecond-scale fire authorization. This architecture reduces dependence on wireless latency and preserves deterministic behavior if connectivity is lost. Table 13 contrasts real-time versus non-real-time functions.

Table 13. Real-time versus non-real-time functions.

Function	Execution Location	Timing Criticality
Sensor acquisition	behind-ear hub/local AFE	hard real-time
Causal feature extraction	hub MCU/NPU	hard real-time
Verifier inference	hub MCU/NPU	hard real-time
Fire scheduling	hub MCU	hard real-time
Charge/current enforcement	dedicated hardware + MCU safety	hard real time
ILC update	hub after swallow	soft real time between swallows
Clinician visualization	phone/clinic application	non-real time
Model fleet analytics/optional federated update	off-device	non-real time; never sole fire authority

14.2. Failure-Mode-Oriented Design

A clinically credible wearable must be designed around failure behavior, not only nominal accuracy. The principal hazards include false stimulation during speech or cough, stimulation with poor electrode contact, runaway or corrupted learned output, stale or delayed sensor data, repeated retriggering, and user discomfort. The present architecture addresses these hazards structurally through independent gates, saturation, refractory lockout, watchdogs, impedance checks, and a tactile OFF path. Formal risk management and verification remain future regulatory work. Table 14 summarizes representative failure modes and design responses.

Table 14. Representative Failure Modes and Design Responses.

Failure Mode	Potential Consequence	Architectural Response
Speech/chew/cough misclassified	inappropriate FES	BI+sEMG+AI corroboration; abstain
Electrode detachment/high impedance	ineffective or uncomfortable stimulation	impedance inhibit
Classifier out-of-distribution input	unreliable probability	confidence/OOD abstention
Software hang	stale stimulation command	watchdog disables HV rail
Rapid repeated triggers	excess duty cycle	refractory lockout
Excess learned dose request	unsafe current/charge	hard saturation independent of AI
User distress	continued stimulation	tactile kill-switch with latched OFF
Wireless failure	loss of remote services	real-time loop remains local

15. Limitations, Translational Requirements, and Future Experiments

The present work is a design-and-feasibility study. The synthetic plant enables multi-seed hard-plant uncertainty, H1 ablation, and EMD Te sensitivity completed in this revision, but cannot reproduce full clinical diversity. HRCA introduces real human signals (N_subj = 12 subset) without BI, EEG, or stimulation. Neither track validates the complete wearable closed-loop in patients. The closed-loop system was not evaluated in living human subjects.

The next decisive experiment is a synchronized multimodal study in which BI, submental sEMG, microphone, accelerometry, and optional ear/glasses EEG are recorded together with VFSS or FEES ground truth. The same session should measure subject-specific EMD from stimulation onset to mechanically observable hyolaryngeal response. Only after these quantities are measured can the Q1 timing model be replaced by individualized empirical distributions and the anticipatory policy be assessed prospectively. Table 15 outlines the proposed translational experiment sequence.

Table 15. Proposed translational experiment sequence.

Stage	Participants/Setting	Primary Measurement	Decision Enabled
1. Bench + phantom	no human participants	stimulator timing, charge balance, watchdog, impedance faults	verify hardware safety functions
2. Healthy feasibility	healthy volunteers	EMD, comfort, electrode repeatability, false triggers	calibrate physical timing and usability
3. Observational dysphagia study	patients; no assistive firing initially	paired BI/sEMG/HRCA/EEG with VFSS/FEES	train/validate multimodal detector and observer
4. Supervised assistive pilot	selected dysphagia patients	Q1 timing, elevation response, adverse events	estimate safe adaptive-control parameters
5. Comparative clinical study	target population	airway safety/efficiency endpoints plus usability	test clinical benefit vs. standard care

15.1. Statistical Plan for a Future Clinical Validation

A future clinical protocol should predefine patient-level train/validation/test separation, primary endpoints, and an analysis hierarchy. Repeated swallows within a patient are not statistically independent; therefore, confidence intervals and hypothesis tests should account for subject clustering. A mixed-effects or hierarchical model is preferable to treating every swallow as an independent observation. The current manuscript does not contain sufficient clinical data to estimate such a model, so no inferential p-values are added retrospectively.

$$y_{ij}={\beta }_0+{\beta }_1\hspace{0.17em}{X}_{ij}+b_i+{\epsilon }_{ij}$$

(55)

where $y_{ij}$ is an outcome for swallow j in subject i, ${\beta }_1$ is the treatment effect, $b_i$ is a subject-specific random intercept, and ${\epsilon }_{ij}$ is residual error. This is a proposed future analysis model, not one fitted to the present data.

15.2. Reproducibility Checklist

Table 16 lists the reproducibility information available from the present study.

Table 16. Reproducibility information available from the present study.

Item	Status/Detail
Random seed	7 for reported synthetic partitioning
Simulation rate	1 kHz
Public HRCA sampling	4 kHz
VFSS conversion	frame x 4000/60
Synthetic test size	280 CL trials + matched OL trials
HRCA analyzed subset	100 files/148 labeled swallows
TinyML architecture	9 inputs; hidden layers [16, 8]; ~305 parameters
Threshold selection	$F_1$-optimal on training folds; engineering fire floor 0.55
EMD prior	50 ms
Reported software stack	Python 3.13; NumPy 2.5.3; SciPy 1.18.1; pandas 3.0.6; scikit-learn 1.9.1

16. Extended Discussion: What the Results Do and Do Not Establish

The combined evidence supports a specific engineering proposition: a compact architecture can be organized so that anticipatory sensing, causal peripheral verification, explicit delay accounting, safety-bounded stimulation, and swallow-to-swallow dose adaptation coexist within a plausible edge-computing workflow. The strongest evidence for timing under real noise comes from HRCA; the strongest evidence for complete control-loop behavior comes from simulation. The two tracks are complementary precisely because neither is sufficient alone.

The results do not establish prevention of aspiration, clinical efficacy in Parkinson disease or stroke, superiority to established dysphagia therapy, or safety of the proposed current amplitudes in a final electrode geometry. The airway-ok variable in simulation is a model proxy. Similarly, modeled Q1 force in HRCA is a timing calculation that applies an EMD assumption; no FES was delivered in the public dataset. Maintaining these distinctions is essential for a scientifically defensible transition from engineering feasibility to clinical investigation.

The main scientific contribution is therefore architectural integration. Prior literature separately supports surface stimulation, BI/sEMG swallow detection, cervical acoustics, wearable EEG, and adaptive-control methods. SafeSwallow combines these components around a hard timing objective and an explicit safety hierarchy. Whether that integration produces clinically meaningful benefit is the central question for the next phase of work.