Off-the-shelf motion sensors and bed mats in senior living run at 5 to 15 false alarms per room per day, and alarm fatigue is the leading reason those deployments fail. Night staff mute the panel, and a muted system detects nothing at all.
The hard problem in fall detection was never spotting a fall. It is refusing to alarm on the ceiling fan, the therapy dog, and someone sitting down hard at 02:13, while still dispatching on the long lie in the bathroom at 02:54. We do not sell sensors. We build the intelligence layer that makes sensors useful. Vigil is that layer for fall detection: it sits between a radar feature stream and the nurse-call system and returns ALERT, SUPPRESS, or ROUTE TO HUMAN, with the deciding feature value logged for every one, so that every alert and every suppression carries a reason you can file. See how it works at https://veriprajna.com/demos/smart-facility-fall-detection.
A suppression is logged the way an alert is, with the value that decided it attached: at 02:13, centroid settled at 0.46 m, seat height rather than floor, with no hard impact.
Sensitivity was the easy half
Our benchmark scores the cascade against a naive incumbent baseline over a fixed set of 360 labeled, noisy synthetic events. The baseline is the off-the-shelf behavior as a single rule: any fast or any low motion is a fall, meaning a peak velocity above 2.0 m/s or a minimum centroid height below 0.45 m. It reaches 1.0 fall sensitivity on that set. So does our cascade. Recall is where the two systems agree.
They separate on confounder specificity: 1.0 for the cascade against 0.167 for the baseline. Under the benchmark's assumption of 30 benign motion triggers per room per day, that projects to 0.0 false alarms per room per day for the cascade and 25.0 for the baseline, against a real-pilot target of under 2. Specificity is the number that decides whether the panel is still switched on a month in.
A naive rule reaches the same 1.0 fall sensitivity as our cascade on the same 360-event set, and collapses to 0.167 confounder specificity. Sensitivity was never the bottleneck.
What a hard sit looks like to a radar feature stream
The demo replays a night shift in a synthetic Memory Care East Wing, 02:00 to 06:00, across 12 monitored spaces. At 02:13 the Decision Ledger records Cam 5 · Bedroom. Someone sits down hard. Peak downward velocity is 2.92 m/s, which is a fall's magnitude.
Vigil's temporal narrative verifier wants four things inside the same 8-second window, with standing established in its opening fifth: a standing centroid above 1.2 m, a descent of more than 0.6 m carrying a peak velocity above 1.8 m/s, a sustained broadband impact (a 3-frame rolling mean above 0.50, so a single-frame spike cannot satisfy it), and a centroid that actually reaches floor level below 0.30 m. The hard sit clears the velocity term and then fails the two that carry the verdict. The centroid settles at 0.46 m, seat height rather than floor. No sustained impact appears. The classifier returns P(fall) 0.004. Vigil suppresses and logs why. The naive rule sees 2.92 m/s and sends a nurse.
The 02:13 ledger row reads SUPPRESS for Cam 5 · Bedroom: "velocity burst but centroid settled at 0.46 m (seat height), not floor; no hard impact." The Cam 3 · Bathroom card above it carries the shift's one ALERT at 99% confidence.
The rest of the night is that shape in different clothes. Cam 1's ceiling fan is a fixed-location Doppler return at (1.5, 1.5, 2.45 m), masked because that room's clutter map was calibrated against it, while the baseline reads 5.0 m/s and alerts. Cam 6's therapy dog carries a radar cross-section of 0.27 and a horizontal aspect ratio of 1.7, and the record names it a non-human target. Cams 7 and 12 are someone bending to pick up a towel, centroid stopping at 0.60 m and 0.59 m with an impact energy of 0.07 against the 0.50 threshold. Over the shift, Vigil alerted once, routed once to a human, suppressed ten, and produced no false alarms; the baseline produced nine alerts, seven of them false.
Suppressions are what a survey actually asks about
A state surveyor reviewing an incident rarely asks why the system alarmed. They ask why it did not, and an absence is exactly what most detection paths never write down.
Every event in the demo opens into a detail panel holding the value that decided it, from its tile or from its ledger row. Cam 10 · Bathroom at 02:41 is the same hard-sit shape as Cam 5, at a 3.31 m/s velocity burst and a centroid settling at 0.44 m.
The Cam 10 · Bathroom detail panel: the SUPPRESS decision with its reason, "velocity burst but centroid settled at 0.44 m (seat height), not floor; no hard impact."
By 06:00 the ledger holds a line for all twelve events across the shift's ten distinct rooms. The shift audit exports as JSON covering every alert, route, and suppression with its deciding feature values and policy reason, which is what a QAPI binder or a CMS F689 file actually needs. The clinical incident note is composed separately from that structured audit evidence and displayed in the incident panel; it is not part of the export.
Every event resolves to a stated cause: Cam 6 · Bedroom as a non-human target at radar cross-section 0.27, Cams 7 and 12 as downward motion that returned to standing with no sustained floor presence.
Where the model is allowed to act
The classifier is a learned logistic model over four features: floor proximity, impact energy, descent drop, and a radar cross-section proxy, fused into a calibrated P(fall). It cannot manufacture an alert on its own. The deterministic narrative conditions have to hold first, and only then is P(fall) checked against a fixed 0.70 floor that the model does not set. The floor-level test at 0.30 m and the breathing floor at 0.20 are plain code with documented constants. Models advise here, and code decides, which is what keeps the reasons readable by a surveyor.
The scope these numbers carry
The 1.0 specificity and the 0.0 false alarms are results on a fixed, author-generated synthetic golden set, not production accuracy, not a clinical result, and not a promise to any facility. The fusion weights were fit on the demo's own scenario generators, the same ones that produce the 360 events, which is the strongest objection a technical reader can raise and we would rather state it than be asked. A real pilot targets under 2 false alarms per room per day after shadow-mode calibration. The whole stream is synthetic radar features: no camera, no image, no video, no PHI, and a logged adapter stub rather than live nurse-call hardware.
The tile we would point a clinical reader at is Real Falls Caught, and it reads 1/2. Two real falls occurred in the shift. Vigil alerted on Cam 3 · Bathroom, the long lie, at 99% confidence with the escalation ladder armed from CNA to Charge Nurse to DON. The other, Cam 2 · Bedroom, is a genuine fall where P(fall) reached 0.99 and the room held two targets. Single-person tracking is outside V1 coverage, so the gate routed it to a staff check at low confidence instead of asserting a fall it could not support.
The scoreboard for the demo shift: 0.0 versus 25 projected false alarms per room per day, 0 versus 7 on the night, 1 of 2 real falls alerted with the other routed to a human, and 100% confounder specificity over 360 labeled synthetic events; a real pilot targets under 2 per room per day.
The separation is earned rather than planted. Each confounder is generated to overlap a real fall on individual features, which is why a single-signal detector is genuinely fooled by it. Sensitivity is measurable in a lab. Specificity is only settled in your building at 3 AM.
The same shift, with every suppression and the value that decided it, is walked through at https://veriprajna.com/demos/smart-facility-fall-detection.
If you operate a memory-care wing, the useful exercise starts with your own alert log. Pull last month's alerts from whatever is installed now and sort them into the fan, the pet, the hard sit, and the bend to pick something up. Then check whether anything in your record can tell a surveyor why the system said nothing about the rest of the night.