Coupled Physiological State Estimation with Uncertainty Quantification
MuseEnGen is a hierarchical adaptive dual-loop architecture for continuous physiological state estimation. The system maintains a real-time, uncertainty-aware model of individual physiology across coupled subsystems, using Unscented Kalman Filter banks on edge hardware and a slow-loop reasoning layer grounded in formal ontology. Designed first for clinically frail users — where the safety case is most acute — and engineered to be inexpensive enough that nearly anyone who wants one can have their own.
A person can appear physiologically stable while their compensatory systems are working near capacity. Heart rate looks normal because the baroreflex is compensating for declining blood volume. Blood pressure holds because vascular resistance is rising to offset falling cardiac output. Every vital sign reads "fine" — but the margin of safety is nearly gone. A small additional stressor that would be trivially absorbed under normal conditions can trigger rapid decompensation.
Threshold-based monitoring cannot see this. It compares individual measurements against population-average limits and alerts when a single number is out of range. The problem is structural: a 120 bpm heart rate means something fundamentally different depending on whether autonomic tone is intact, fluid volume is adequate, and the cardiovascular system has headroom. Threshold monitoring sees 120 bpm. A coupled state estimator sees the combination of states that produced it — and can distinguish compensation from crisis.
This motivates the Health Triad: three coupled signals that capture not just where the body is, but how hard it is working to stay there and how much capacity remains.
Homeostatic regulation quality — how well the body is maintaining its regulatory set points. Estimated from innovation sequences across the UKF filter bank — persistent deviations between predicted and observed states indicate regulatory strain before overt symptoms appear.
Homeostatic reserve — the remaining capacity to absorb perturbation. Modeled via a nonlinear sigmoid that captures cliff-edge fragility: small additional stressors produce disproportionate decline when reserve is low. The system becomes more conservative as reserve contracts.
Allostatic load — cumulative burden from sustained activation and incomplete recovery. Tracks the integral of allostatic activation over time, gated by recovery quality. Wear accumulates when stress is persistent and recovery windows are insufficient — the biological cost of chronic compensatory effort.
The system separates into two complementary loops. PA (the fast loop) runs real-time state estimation on edge hardware — a bank of Unscented Kalman Filters estimating latent physiological states across four Tier 1 subsystems: Cardiovascular, Autonomic Nervous System, Fluid/Volume, and Respiratory. MA (the slow loop) performs longitudinal adaptation and causal reasoning, personalizing the edge model through bounded prior updates and generating uncertainty-quantified hypotheses about physiological trajectory.
The architecture enforces a three-layer control hierarchy with strict latency and authority separation:
| Layer | Latency | Function |
|---|---|---|
| L1 — MCU | < 2 ms | Hard real-time deterministic safety. Threshold-based. Cannot be overridden by higher-level software. Reflex-layer responses: fall detection, hypoxia alarm, kinematic stabilization. |
| L2 — Edge | < 20 ms @ 1 Hz | UKF filter bank across four Tier 1 physiological subsystems. Health Triad computation. Short-horizon prediction with covariance propagation. All estimation runs on-device. |
| L3 — Cloud | Hours–months | Longitudinal physiological modeling. Personalization via bounded prior updates with rate limiting, shadow-mode validation, and automatic rollback. Ontology-grounded causal reasoning. |
The MCU safety loop is deterministic and independent — it cannot be delayed or overridden by the Jetson or cloud layers. Raw biometric waveforms never leave the edge device; upstream communication is limited to aggregated Health Triad summaries with uncertainty bounds, on minimum windowed intervals. When the model's uncertainty increases, the system's autonomy contracts — it does less, not more. Every MA parameter update flows through a rate-limited safety interface with hard bounds.
MuseEnGen is developed using a structured multi-model AI ensemble workflow — a methodology that treats frontier AI models as specialized co-architects with strict role boundaries, governed by structural invariants rather than prose guidelines. The pattern has been validated across 35+ architectural decisions, 17 safety case hazards, and a 90+ file specification suite.
The core insight: different AI models fail in fundamentally different ways. A model that excels at mathematical rigor may miss a biologically implausible parameter. A model that catches engineering feasibility issues may not notice a formal logic gap. Heterogeneous model ensembles catch error classes that no single model — human or AI — catches alone.
Cross-document consistency, specification synthesis, architectural reasoning, completeness audits. Cannot execute on the repository.
Equation auditing, formal specification, BFO ontology correctness, interface contract verification. Multi-round review cycles.
Physiological plausibility, parameter range verification, clinical scenario realism, scientific accuracy against current literature.
Hardware implementability, compute budget verification, RF/wireless analysis, thermal envelope compliance, deployment realism.
A human decision-maker retains full authority over all merges, invariants, and design choices. The workflow is governed by single-source-of-truth hierarchies, architectural decision records with orphan checks, version currency gates, and role-specific preambles that constrain each model's review scope. The methodology is described in the white paper below and is offered as a transferable pattern for any engineering team.
This section states what has been validated, what is in progress, and what remains open. The system is in early development — the program phase is developer dogfood build and MA reasoning MVP preparation.
| Component | Status | Evidence |
|---|---|---|
| UKF core infrastructure | Implemented | Merwe scaled sigma-point UKF with Tier 0 sensor fidelity modulation. Innovation history for Ljung-Box validation. Coupling interface for multi-layer operation. |
| ANS layer estimation | Validated in harness | Six physiological scenarios (rest, stress, exercise, sleep, orthostatic, panic spiral). RMSE: φ_s ≈ 0.03, φ_p ≈ 0.01. Ljung-Box: 3/4 channels pass (p > 0.05). RMSSD fails during rapid transitions — known Q tuning issue, documented. |
| Panic spiral model | Validated in harness | RESP→ANS→RESP positive feedback loop correctly modeled and detected in simulation. |
| PA Zero integration | In progress | INT1 committed (285+ tests passing). Two bugs blocking live smoke test: sigmoid overflow guard and keystroke channel persistence. Fixes identified, not yet deployed. |
| CV, FV, RESP layers | Not implemented | Specified in Model Spec v0.3.6. ANS layer serves as reference implementation. |
| Live physiological data | Blocked | No live human data yet. All validation uses synthetic ground truth. Polar H10 on hand; BLE bridge not yet built. |
| Enrollment pipeline | Not started | Specified (RED→YELLOW→GREEN traffic light). Requires 7+ days live data. Founder is User 1. |
| MA reasoning layer | Spec complete | Predicate grounding and rules specified (v0.2). BFO 2020 ontology grounded. No runtime implementation. Six modes defined; all shadow-mode before user-facing output. |
| Parameter Safety Interface | Not implemented | Specified: hard bounds, rate limiter, shadow mode, automatic rollback. Required before MA→PA coupling. |
| Hardware-in-the-loop testing | Not started | HIL harness specified (F09 orthostatic collapse). Requires timebase authority resolution. |
| Safety case | Partial evidence | 17 hazards cataloged (H-01–H-17). Mitigations specified for all. Evidence for subset. No actuators in current version — several hazards vacuously satisfied. |
The honest summary: the ANS layer works in simulation against synthetic data and passes standard statistical validation tests. Nothing has been validated against live human physiology yet. Three of four Tier 1 subsystem UKFs are not yet implemented. The MA reasoning layer is specified but not built. The system has zero clinical validation. These gaps are known, tracked, and sequenced — they are not hidden.
MuseEnGen is designed to monitor, estimate, suggest, and support. It does not claim to diagnose, treat, cure, or provide medical advice.
Every hypothesis output is accompanied by uncertainty quantification. No point estimates without confidence bounds in user-facing output. MA reasoning uses language such as "physiological deterioration likely" — never "infection detected." Suggested actions are framed as "suggests consideration of [intervention class] for clinician review" — never specific therapeutic recommendations.
This is not a disclaimer. It is an architectural commitment enforced across all specifications, external communications, and user-facing outputs through a set of claims boundary invariants that all project contributors — human and AI — must satisfy.
The project is staged deliberately. Each phase earns the right to the next through validated evidence, not schedule pressure. No scope expansion without passing the current phase gate.
Validated safety loop on edge hardware. All interventions require clinician authorization. Tier 1 UKF filter bank validated. Health Triad computation live. Constrained to clinically frail users in supervised care settings. System suggests; clinician decides and authorizes.
Bounded protocol autonomy within physician-defined envelopes. Autonomous intervention protocols for validated failure modes. Tier 2 subsystems (endocrine, metabolic, immune). System acts within validated envelopes; physician oversight continues.
Adaptive structural modeling. Closed-loop damage accumulation tracking. Fully personalized biological regulator with user sovereignty.
These are project working documents — not peer-reviewed publications. They describe the methodology, architecture, and safety reasoning as they currently stand. They are shared publicly in the interest of transparency and because the methodology work may be independently useful to other engineering teams.
A workflow pattern for engineering teams using multiple AI models as specialized co-architects. Describes role-specific preambles, single-source-of-truth hierarchies, ADR orphan checks, version currency gates, and structured ensemble review. Domain-independent. This is a methodological contribution, not a claim of clinical validation for the physiological system.
Condensed operational reference for the ensemble workflow. Four roles (Decider, Architect, Executor, Reviewers), the workflow loop, and six governing principles.
Argues that physiological regulation systems require both semantic discipline and quantitative dynamics. Introduces the MA/BFO-T → PA/ODE relationship: ontology constrains meaning and temporal scope while ODE computes state evolution. Describes how this separation preserves distinctions between state, burden, process profile, and explanation.
Formalizes an invariant family requiring that uncertainty quantification obligations propagate through any recursive self-improvement pathway. Currently in internal ensemble review; will be posted here after ratification.
MuseEnGen is founded and led by Jeff Hall. The project is explicitly non-commercial: the mission is a personalized MA & PA instance, engineered to be inexpensive enough that nearly anyone who wants one can have their own. Version 1 earns the right to Version 2.
Electrical Engineering and Physics, University of Michigan. 30+ years across automotive systems, Department of Defense programs, and startup environments.