On a wearable controller for a neural implant the specification that matters is jitter, not latency. The implant is unserviceable, so every changeable function belongs in the hub. Standard Bluetooth cannot sit inside a millisecond control loop, so the radio carries stimulation patterns rather than samples, and the loop closes at the implant against a synchronized clock.
A sensory restoration system splits into two halves with very different service lives. The implant is placed surgically and stays. The wearable hub sits on the body, charges nightly, and can be replaced or updated at any point. Every architectural decision on this class of device follows from that asymmetry, and the ones that go wrong go wrong because a team treated the two halves as peers.
The program described here was a wearable controller that reads real-time gait data and turns it into intraneural stimulation patterns, built on an nRF54L15 with Zephyr RTOS, BLE 5.4, a six-axis IMU, local flash logging, and USB-C charging with Li-ion management. OVA Solutions builds medical device hardware for a living. Our 62 engineers have shipped more than 200 devices, and on this program our scope covered component selection, firmware engineering, and functional prototyping.
Push everything into the part you can service
Real-world longevity data for implanted stimulators is more sobering than the marketing suggests. A 2023 Medicare analysis covering 106,462 spinal cord stimulation devices put projected median longevity at 8.2 years for primary cell systems and 9.0 years for rechargeable ones, a difference far smaller than the design assumption behind rechargeable implants. Deep brain stimulation data from 2025 puts median implantable pulse generator longevity at 75.9 months, close to six and a half years, with stimulation parameters strongly influencing the result.
Read that as an engineering instruction rather than a market statistic. Anything running inside the body is on a multi-year clock that ends in a surgical procedure, and anything that changes the implant’s power draw moves that date. So computation, storage, connectivity, algorithm updates, and diagnostic logging all belong in the wearable hub. The implant should execute, not decide.
That principle has a practical corollary that teams often resist: design the system so the implant never needs a firmware update. Put the update surface entirely in the hub and the mobile application, and treat implant firmware as frozen at the point of implantation.
The wireless link cannot carry the control loop
Closed-loop sensory feedback runs on tight latency targets. The bands on this program were our own, set in the project’s requirements rather than taken from a published consensus: a useful closed-loop effect below 10 milliseconds, feedback that integrates naturally with motor circuits at 1 to 5 milliseconds, and biomimetic stimulation at its best below 1 millisecond. A 2013 study on high-density arrays ran closed-loop stimulation at a 400 microsecond minimum programmable latency with jitter under 50 microseconds.
Standard Bluetooth Low Energy cannot meet those numbers, and the reason is structural rather than incidental. Bluetooth core specifications through 6.1 set the minimum connection interval at 7.5 milliseconds, and the device described here was built on BLE 5.4. Core 6.2 has since cut that floor to 375 microseconds, which changes the arithmetic for a program starting today and not for this one. A single hop over a standard BLE connection therefore has a floor at 7.5 milliseconds before processing, and a naive architecture with a wireless sensor node feeding a hub which then feeds an implant stacks two of those intervals and lands outside the useful window entirely.
The architecture that works accepts this instead of fighting it. The IMU sits local to the hub, wired, so the sensing hop costs microseconds rather than milliseconds. The wireless link to the implant carries stimulation patterns and parameter updates rather than a sample stream, and the implant executes those patterns locally against a synchronized clock. The loop closes at the endpoint, and the radio carries the model rather than the signal.
That is a generalizable rule for any distributed real-time system. When the link latency exceeds the control period, stop streaming the loop and start streaming the model.
Jitter is harder than latency and gets budgeted less
Most teams write a latency budget. Very few write a jitter budget, and on this device class jitter is the more demanding specification.
The evidence for why sits in a cortical closed-loop experiment published in 2023 in mice, where the animals learned the task only when the artificial feedback moved across the sensory cortex as a pattern that was contiguous in space and time, not merely delivered in real time. What the nervous system is reading is the internal structure of the pattern, and timing variance destroys structure in a way that constant delay does not. A consistently late signal is a signal the brain can adapt to. A signal whose timing wanders is a different signal every time.
BLE is comparatively good on mean latency and comparatively poor on variance, because connection events, retransmissions, channel map updates, and 2.4 GHz coexistence all introduce timing spread rather than constant delay. Any architecture that puts the wireless hop inside the perceptual loop inherits that spread directly.
The practical requirement is a per-hop jitter budget written alongside the latency budget at architecture time, with a measurement plan attached. Local flash logging on the hub exists partly for this: a three millisecond timing budget cannot be debugged through a mobile application, and it cannot be debugged after the fact without timestamped records captured on the device itself.
Optimize active current, not sleep current
Wearable power design has a default reflex, which is to minimize sleep current. On a device that never really sleeps, that reflex is wrong, and the published silicon data makes the point clearly.
Comparing the nRF54L family against the nRF52840, active CPU current runs about 2.6 mA against 3.3 mA, and receive current is roughly half. Transmit current at 0 dBm runs about 4.8 mA against 6.4 mA, roughly a quarter lower. In deep sleep the older part is often better: the nRF52840 holds RAM at about 2.35 microamps against 2.9 for the nRF54L, and sits in system off at 0.4 against 0.7. Nordic’s medical-oriented nRF54LV10A claims 30 to 50 percent lower power in common BLE use cases, and it wins through shorter radio-on time and faster computation rather than through a lower floor.
The conclusion for a continuously operating closed-loop device is that average current dominates and the sleep figure is close to irrelevant. Select the part that finishes the work fastest and gets the radio off soonest, and evaluate it on a realistic duty cycle rather than on a datasheet sleep number.
The short version for a program director
Treat the implant as unserviceable and push every changeable thing into the hub, including the entire update surface. Keep the sensing hop wired and local so the wireless link is never inside the control loop. Send patterns and parameters over the radio rather than samples, and close the loop at the endpoint against a synchronized clock. Write a per-hop jitter budget next to the latency budget and attach a measurement plan to it. Log timing on-device, because a millisecond-scale budget is not observable from a phone. Select silicon on active current at a realistic duty cycle rather than on sleep current.
This system reached functional prototype. Whatever performance figures a program in this category eventually publishes, the one worth insisting on is the per-hop jitter distribution, stated with its tail and not just its mean, because it determines whether the nervous system can use the signal at all and it is the figure most likely to be missing from the report.
Common questions
Why should the implant never need a firmware update?
Because anything running inside the body is on a multi-year clock that ends in a surgical procedure, and anything that changes the implant’s power draw moves that date. A 2023 Medicare analysis of 106,462 spinal cord stimulation devices put projected median longevity at 8.2 years for primary cell systems and 9.0 years for rechargeable ones. Put the update surface entirely in the hub and the mobile application, and treat implant firmware as frozen at implantation.
Why can a standard Bluetooth link not carry the control loop?
Bluetooth core specifications through 6.1 set the minimum connection interval at 7.5 milliseconds, and this device was built on BLE 5.4. A single hop therefore has a floor at 7.5 milliseconds before any processing, and a wireless sensor node feeding a hub which feeds an implant stacks two of those intervals. Core 6.2 has since cut the floor to 375 microseconds, which changes the arithmetic for a program starting today and not for this one.
What does it mean to stream the model rather than the loop?
The IMU sits local to the hub and wired, so the sensing hop costs microseconds rather than milliseconds. The wireless link to the implant carries stimulation patterns and parameter updates rather than a sample stream, and the implant executes those patterns locally against a synchronized clock. The rule generalizes to any distributed real-time system: when link latency exceeds the control period, stop streaming the loop and start streaming the model.
Why is jitter harder to hit than latency?
A cortical closed-loop experiment in mice published in 2023 found that learning occurred only when the artificial feedback was contiguous in space and time, not merely fast. The nervous system reads the pattern’s internal structure, and timing variance destroys structure in a way that constant delay does not. A consistently late signal can be adapted to. A signal whose timing wanders is a different signal every time, and BLE is poor on exactly that variance.
Why optimize active current rather than sleep current on this device?
The device never really sleeps, so average current dominates and the sleep figure is close to irrelevant. Against the nRF52840, the nRF54L family runs about 2.6 mA active CPU current against 3.3 mA and transmits at 0 dBm at about 4.8 mA against 6.4 mA, while in deep sleep the older part is often better. Select the part that finishes the work fastest and gets the radio off soonest, judged on a realistic duty cycle.
Why does the hub need local flash logging?
Because a three millisecond timing budget cannot be debugged through a mobile application, and it cannot be debugged after the fact without timestamped records captured on the device itself. Local flash on the hub exists partly to make the per-hop jitter distribution observable, with its tail and not just its mean, because that distribution determines whether the nervous system can use the signal at all.
Sources: Medicare spinal cord stimulation longevity analysis, 2023, n=106,462 · DBS implantable pulse generator longevity study, 2025 · sub-millisecond closed-loop stimulation study, 2013 · cortical feedback patterning experiment in mice, 2023 · Bluetooth SIG, connection interval limits · Nordic Semiconductor, nRF54L and nRF52840 power figures · Nordic Semiconductor, nRF54LV10A announcement
Lisa Voronkova is a medical device development expert and CEO of OVA Solutions, an R&D firm of 62 engineers that has shipped over 200 devices. She holds a PhD in applied mathematics and wrote Hardware Bible: Build a Medical Device from Scratch.
If you are building something in this space, we are glad to look at it with you. Grab a slot on Lisa’s calendar at calendly.com/lisa-voronkova/30min, and if nothing there works, write to lisa@ovasolutions.com.