Integrated recorder verification

Project lead: Muttakin Rahman · 1 October 2026 · AD7606 / two EMG inputs / ICM-42688-P

12 October 2026: all 18 integrated cases pass on firmware 1.12 in Wokwi’s web editor. Each case ran the production recorder on the rebuilt simulation image (simulations/integrated-recorder/firmware/, merged image 1430e1ae…). Each complete serial export was checked with the production converter and live decoder. The 1.12 ledger and its timing audit show:

• The nominal run saves 10,039 EMG, 262 foot and 251 shank records with no detected loss.
• IMU timestamps advance in 32/30 µs ticks at 200 Hz.
• Session metadata is 1,317 of 1,400 bytes.
• Every fault case stops with its expected reason.
• Each case folder keeps the Wokwi logic-analyzer trace (logic.vcd.gz, first 1.34 s, limited by the 1,000,000-sample buffer).

Getting there exposed one firmware race and three fixture problems:

• Firmware race (fixed in 1.12). On the 1.11 image, 10 of 11 executed cases passed (1.11 ledger). The IMU missing-interrupt case failed because the Wi-Fi preview sent a new session's first data packet before that session's metadata, so the laptop receiver dropped it as an unknown session. The live task could dequeue the first record after its per-loop metadata check had already run for the previous session. 1.12 announces the session before sending its data; the same case then passed.
• Fixture memory. The fixture's PSRAM disk substitute ran out of memory once the firmware's 1.31 MB PSRAM record queue (added in 1.7) was also allocated. It now reserves 1.75 MB of disk pages and a 2.5 MB UDP capture.
• Fixture UDP buffer. Its UDP receive buffer still assumed the 1.6 metadata limit.
• Queue-stall expectation. The 1.6 queue-stall case expected a queue-overflow stop. The 1.7+ 2.44 s queue absorbs a 350 ms write stall by design (peak 2,936 of 20,480 records, nothing dropped), so the case now stops like the nominal run and expects a normal stop. Queue-overflow detection stays covered by the native recorder harness.

Superseded first-fixture runs are kept in results/web-1.11-first-fixture/. The 1.11 ledger was re-assessed after the source change in a mode that records that its image could no longer be matched against the current tree. Wokwi's CLI was not used: the account's monthly CI quota was exhausted (results/cli-1.10/). This remains simulated execution with documented substitutes, not measured hardware.

11 October 2026 (rerun prepared): the simulation image was rebuilt from source set ad7606-2ch-1.10 (simulations/integrated-recorder/firmware/). The Wokwi ICM model now emits 32/30 µs ticks (4,687.5 per 200 Hz sample), and the timing audit reads each capture's own tick scale and metadata limit, so the 1.6 evidence still audits unchanged. The first CLI attempt was refused because the account's Free-plan monthly CI quota was used up. The refusal is kept in results/cli-1.10/ and is not counted as a pass or a failure. Until the matrix runs, the 18 passing cases below apply to the 1.6 image only. Earlier on 11 October 2026: source set ad7606-2ch-1.10 uses the official datasheet clock tolerance (±2 %) in the bench verdicts; ad7606-2ch-1.9 added IMU-only bench diagnostics; source set ad7606-2ch-1.8 converts ICM-42688 FIFO timestamp ticks as 32/30 µs (TDK driver PLL scale) instead of 1 µs; the Wokwi ICM model below emitted 1 µs ticks and was not changed. 10 October 2026: Source set ad7606-2ch-1.7 (10 October 2026) moves the SD record queue to PSRAM and enlarges it from 2,048 to 20,480 records (about 0.244 s to 2.44 s), generates a random Wi-Fi password on each recorder instead of compiling one in, raises the live-metadata limit to 1,400 bytes, and adds IMU timestamp-scale checks. All seven 1.7 profiles compile and the native recorder-control cases pass again; the Wokwi integrated runs below used the 1.6 image and have not been repeated for 1.7. In particular, the queue-stall-350ms overflow below is 1.6 behavior; the 1.7 queue model absorbs stalls up to about 2.4 s.

All 18 current v1.6 integrated cases pass in Wokwi’s web simulator, with complete serial exports checked by the actual converter and live decoder. The nominal run saves 10,041 EMG frames, 263 foot and 252 shank records, with no detected saved-sample loss or acquisition errors. This is actual ESP-IDF execution with documented peripheral substitutions, not measured hardware performance. The nominal best-effort preview drops one EMG frame and reports it explicitly; the independent saved recording is complete.

Execution and review corrected delayed ADC servicing, backwards IMU time estimates, missing conversion acknowledgement and startup stack allocation. The full current integrated case matrix passes; physical acceptance and a current downloaded VCD trace remain unqualified. Earlier failed or partial attempts are retained rather than relabeled.

This report covers this configuration only. The other five designs retain their previous files and validation status. Electrical connections, PCB geometry and manufacturing files have not changed in this refinement.

See the complete system: the physical assembly and a separate saved Wokwi scene include power, both EMG paths, both IMUs, storage, controls and laptop context. The expanded scene passed an additional nominal run. The eighteen-case results below retain their original protocol-fixture diagrams.

3 October follow-up: a complete-scene digital pin observer passes 10,041 ADC trigger/read checks and both 200 Hz IMU interrupt streams. The saved-data audit and interpretation guide independently compares 21,116 original records across two captures with every exported CSV row, verifies channel identity and nominal units, and confirms byte parity between received preview records and the saved file. Native full-session VCD download and hardware timing remain unqualified.

Tested versions

The integrated image below was built from source set ad7606-2ch-1.6. Current laboratory firmware is ad7606-2ch-1.12; all nine profiles compile and its integrated image passes all 18 web cases (see above). The separate integrated image executes the production recorder, sensor drivers, serializer and Wi-Fi task with fixture wrappers. Its 31-file source/configuration/model/image manifest, boot ELF identifier and each saved diagram identify the tested build. The current 18-case web ledger is distinct from the pre-web quota-refused candidate.

The earlier v1.5 cloud ledger has 16 cases and remains incomplete. Its exact tested snapshot, failed attempts, partial battery export and CLI transport errors are preserved. A current web success does not change those historical outcomes. Newly rebuilt laboratory binaries have not been flashed; the instrumented integrated image is a different binary.

Wokwi officially supports ESP32-S3 and custom firmware upload and custom C chip models. The supported web-editor path completed despite CLI CI quota refusal. Its ADC C source inlines the stimulus header and removes only the header-specific pragma; callbacks and values are unchanged. Reproducible web files and transformation manifest.

What executed together

The Wokwi image includes the production main.c, AD7606 and ICM drivers, serializer and Wi-Fi task. Actual ESP-IDF v5.4.2 FreeRTOS tasks acquire data, queue records, write and synchronize a real FatFS filesystem, initialize the ESP32 access point, and send actual AFW1 datagrams through lwIP. The real laptop decoder and converter process the exported bytes.

Four substitutions define the scope:

Wokwi’s supplied microSD model uses SPI; it cannot validate this recorder’s unchanged SDMMC wiring. Wokwi microSD documentation. Access-point startup and UDP loopback do not establish over-the-air reception. Wokwi networking documentation.

The simulation-only binary has additional trace instrumentation and fixture wrappers. Never flash it onto the recorder. Laboratory images are under firmware/builds/; simulation images are under simulations/. Executed v1.5 source, configuration and image hashes.

Corrections

Conversion timing

The original recorder waited for the falling BUSY interrupt. In the combined simulation that notification arrived after the next 125 µs deadline, after about 2,385 valid frames. The driver correctly refused to overwrite an unread conversion, but continuous recording stopped. The failed capture remains in the package.

The acquisition timer and GPIO service now belong to core 1. After each CONVST pulse, the timer notifies the EMG task directly. The task checks BUSY before starting SCLK and fails after an 80 µs readiness wait. The next-period unread-result guard remains active. SPI still reads all eight 16-bit words through DOUTA in mode 2; only EMG1 and EMG2 are exported. A conversion deadline failure reports timing reason 6.

This removes the second interrupt handoff. It does not prove physical scheduling margins. Higher-priority interrupt experiments caused kernel failures and were reverted; those failed attempts are retained. The final combined run uses the ordinary interrupt priority and an enabled task watchdog.

Missing BUSY assertion — current v1.6

A disconnected/stuck-low BUSY pin or ignored CONVST pulse could previously leave BUSY low and permit a serial read of stale conversion words. The current driver requires BUSY to be high at the end of the existing 1 µs CONVST pulse. This is consistent with the AD7606 Rev G timing limits: BUSY asserts within 45 ns, while the shortest listed conversion is 3.45 µs with oversampling disabled. A missing assertion latches a timing fault before accepting a frame. The later bounded BUSY-low wait still rejects stuck-high or delayed completion.

Sixteen native ADC groups and the local C pipeline exercise this correction, including independently injected stuck-low BUSY and ignored CONVST. This is mocked API evidence. Current v1.6 web execution independently rejects stuck-high BUSY, stuck-low BUSY and ignored CONVST with reason 6, an ADC error and zero accepted EMG frames. Earlier captures establish their own v1.5 behavior only. Physical timing and voltage checks remain required.

IMU time reconstruction

Re-anchoring every FIFO burst to the latest interrupt created 35 backwards host-time estimates in one otherwise complete capture. An IRQ and a FIFO-count read can observe different sample boundaries.

The recorder now anchors the first estimate and advances subsequent estimates using the stored 16-bit sensor timestamp increments. Each IMU keeps its own state. Zero or implausible increments, backwards read times, and an unread interval spanning an entire 65,536 µs rollover are rejected explicitly. Missing counter intervals remain flagged. An IRQ arriving during a read indicates timing uncertainty; it does not by itself establish missing samples.

The raw FIFO packet, IRQ anchor and read window remain in every record. imu_time=fifo_delta_first_irq identifies the revised method. Estimates remain uncalibrated: sensor-clock drift, the initial anchor error and filter delays are not corrected. Legacy files retain their original interpretation.

The wireless sender also collects short batches rather than sending almost every EMG record in a separate datagram. Its collection target is 2 ms; RTOS scheduling and transport can add latency. Wi-Fi remains best-effort and cannot block or replace the saved recording.

Current v1.6 integrated results

Every case below completed on the same current ESP32-S3 image. The assessor verifies the boot image identifier and diagram, contiguous export offsets, exact terminators, binary CRCs, channel identities, known ADC codes, converted quality and the actual AFW decoder state. Refusals deliberately produce no recording. Fault cases pass when they expose the specified abnormal outcome, not when they appear loss-free.

Current nominal quality · current explicitly synthetic recording · filtered signal plot.

The low-battery fixture now yields during post-recording serial export. Both export terminators completed; the earlier v1.5 partial dump remains partial. This checks the simulated low-voltage response, not measured battery runtime. No current native downloaded VCD is available. The later pin-observer waveform is a partial capture derived from observed simulated transitions, with separately checked complete-session counters; it does not qualify a native full-session VCD.

Startup stack correction

The additional Espressif QEMU experiment exposed startup stack pressure: the compiler had inlined session buffers into the startup function used by NVS/network initialization. Keeping record_session separate reduces the compiler's startup frame from 2,640 to 352 bytes, while retaining an 8 KiB main stack. All seven profiles were rebuilt, the 38 native control cases rerun, and the current Wokwi matrix executed after this change. This is not measured peak stack usage on hardware.

Independent offline emulator

The QEMU experiment retains seven outcomes: three initialization-refusal passes, one generic abnormal-stop pass and three failed qualification cases. Its nominal run cannot meet the unchanged 1 µs BUSY observation and 125 µs sampling deadlines and stops before accepting EMG. Its specific ADC fault paths are not established where scheduler failure can mask injection. QEMU is not counted as a qualified continuous-acquisition result. The failed matrix, exact image, substitutions and vendor runtime identity are retained.

Preserved v1.5 integrated capture results

Sixteen cases were requested. Ten completed with successful CLI execution and all applicable saved-file/laptop checks. A separate nominal run completed and passed every firmware/file/UDP check, but its optional VCD retrieval ended with an API transport error. The low-battery run reached the correct saved stop; its UDP export was incomplete. Four cases did not execute because Wokwi exhausted the account’s monthly CI quota. They are not counted as passes.

The nominal EMG rate derived from ESP32 timestamps is approximately 7,983.87 Hz, within the declared virtual gate of 8 kHz ±1%. Foot/shank counts differ because the sensors start at different times and run independently. All 515 IMU records retain the timing-uncertain flag; none is presented as a calibrated timestamp.

Complete result ledger · nominal recording · nominal quality report · wireless loss report.

Losing a wireless END is allowed by a best-effort link. The receiver correctly leaves ended=false and stop_reason=null; it must not invent a normal stop. The original test incorrectly required END despite deliberately dropping datagrams. Its initial failure and corrected assessment are both retained.

The low-battery fixture emitted idle-watchdog warnings while exporting a large serial dump after recording had stopped, and the 30-second capture limit expired before the UDP export terminator. The saved low-battery file is readable; this does not complete the wireless or whole-case gate. The current fixture yields an RTOS tick between post-recording export chunks, and the runner allows a 120-second simulated export window. The current web battery case now completes both exports; these are harness changes, and the original v1.5 case remains partial.

All captures are synthetic. .raw files preserve the unmodified production output, including its original synthetic=false metadata field. The companion .afolog fixtures explicitly set synthetic=true. Neither contains a human recording.

Local verification beyond the cloud runs

The local pipeline feeds ngspice-filtered, explicitly synthetic RAW-like signals through the actual C peripheral drivers and serializer. A separate mocked register/FIFO model supplies the IMUs. It also confirms that a wrong serial mode can return plausible -1 ADC values: known-input qualification is essential because the original AD7606 has no sensor-frame CRC or identity register.

The extended native pipeline covers 60 seconds of ordered C execution at the configured rates. The foot/shank models use +70/−110 ppm clocks, with 916/915 timestamp-counter rollovers respectively. Foot starts earlier and has one generated packet still in FIFO at stop; shank has none pending. All generated-versus-saved counts are explicit. This exercises counter rollover and recording conversion under modeled clocks, not a 60-second ESP32 scheduler, SDMMC or radio endurance test. The shorter two-second fixture and its plotted waveform remain available below.

60-second pipeline evidence · current behavioral model checks.

Local pipeline evidence · generated recording · analog response · queue budget.

At 8,000 EMG frames and 400 IMU records per second, 64-byte records consume approximately 537,600 bytes/s before status/header overhead. Source set 1.6 had a 2,048-record queue (about 244 ms of arrivals); 1.7 holds 20,480 records in PSRAM (about 2.44 s). The rerun model adds one-hour cases with 350, 500 and 1,000 ms stalls, which stay below capacity, and a 2.6 s stall that overflows. The one-hour model uses an assumed 2 MiB/s writer and specified stalls; it does not measure any card. A two-hour file is nominally about 3.87 GB, including per-second status records, under the individual FAT32 file limit documented by Microsoft. Actual card latency, free space and recording durability remain unqualified.

The previous seven diagnostic Wokwi scenarios and 300 FreeRTOS join/lifecycle cycles remain historical evidence. Their tested images and sources are preserved separately. The seven newly compiled laboratory profiles have not all been rerun in Wokwi; the current integrated web matrix does not establish that claim. Historical diagnostic source/image snapshot.

Captured timing audit

Current v1.6 post-processing passes timing checks for all 15 captures with recordings; the other three cases refuse initialization/start. In the current nominal file, trigger intervals span 122–128 µs, trigger-to-read-start is 7–11 µs, reads take 23–29 µs, and recorded completion precedes the next trigger by 89–97 µs. The timestamp-derived rate is approximately 7,983.86 Hz, within the declared 8 kHz ±1% virtual gate. The estimated first-shank/first-foot offset remains 55,001 µs, with 11 additional foot startup packets. These are instrumented file timestamps from ideal behavioral models, not a downloaded logic waveform or calibrated hardware measurement. Current timing audit.

Nine post-processing test cases pass for the timing auditor, including known nominal evidence, counter rollover, causality, missing-gap flags and rejection of re-anchored or future estimates. This inspects existing v1.5 captures; it is not new firmware execution.

In the nominal file, CONVST timestamp intervals span 122–129 µs; trigger-to-read-start is 6–12 µs; recorded read duration is 23–29 µs; read completion precedes the next trigger by 89–98 µs. Both modeled IMU counters advance by 5,000 µs per packet, corresponding to 200 Hz. These observations describe the captured behavioral-model run, not physical interrupt jitter or clock accuracy.

The first shank estimate is 55,001 µs after the first foot estimate, and foot has 11 additional startup packets. The firmware starts the sensors sequentially, with a 50 ms wait per imu_start; their counters have independent origins. This startup offset is explicit rather than called missing data. It does not calibrate foot/shank synchronization or EMG-to-IMU alignment. All reconstructed IMU estimates remain flagged uncertain.

The retained stuck-BUSY trace contains two initialization reads before the first CONVST, then one trigger and no post-trigger ADC read. RESET is not an analyzer channel, so the initialization classification relies on the known driver path rather than observing RESET directly. Timing audit and raw-file hashes.

Laptop receiver, API and live display

Current v1.6 AFW datagrams pass through a real loopback UDP socket into the actual receiver subprocess and HTTP API. Its live page is checked in the browser, reception is paused to verify the unavailable-link state, and the archived measurement bytes are compared exactly with received AFR records before conversion. Only metadata is marked synthetic. Corrupted CRCs and duplicate packets are rejected without adding measurements.

Both replays pass byte preservation, actual socket/API, browser, fault rejection and archive checks. Both laptop conversions intentionally return the quality-warning exit code 2. Passing this test means missing data is reported accurately; it does not mean wireless capture is loss-free. The source SD recordings remain complete.

Earlier v1.5 loss replay remains evidence of a lost END: ended=false, unknown reason and explicit missing-END quality. The new loss run delivered END, so its ending is retained without concealing gaps. The replay test now derives gaps and ending from the actual source rather than assuming a fixed packet-discard outcome. Its initial incorrect expectation and earlier runner are preserved.

The page shows EMG1/2 only, correct approximately 1 V/2 V scaling, separate foot/shank values, timing uncertainty and a synthetic-data banner. No physical radio connection was exercised. Current laptop results · reproduction guide.

What is still required

The current 18-case integrated matrix passes with the stated models and substitutions. The independent QEMU nominal qualification remains failed, and no new downloaded VCD or fresh execution of every laboratory diagnostic binary is claimed. Physical acceptance has not passed. The package keeps those limitations, historical failures, source/image hashes and empty measured-results sheets visible.

Simulation cannot determine the received RoboticsBD board’s actual serial straps, VIO, reference or output voltage, nor real analog noise, protection behavior, power startup, temperature, crosstalk, cable integrity, radio performance, SDMMC reliability or battery runtime. The first physical gate remains ADC-module voltage/mode/reference qualification before ESP32 signal connections. Lab and human-testing prerequisites are unchanged; no board order is recommended or placed.

Follow the variant-specific lab sequence when instruments become available. In the meantime, the integrated harness and offline pipeline can reproduce the checks within their declared limits.