9. Digital Control and Embedded Implementation

Introduction and Context

Modern electrical drives are controlled by executing mathematical algorithms in digital hardware. A drive controller may be implemented in a digital signal processor (DSP), a microcontroller, a field-programmable gate array (FPGA), or a heterogeneous platform combining several of these technologies. Digital implementation has transformed drive control from an arrangement of analogue compensators and discrete logic into a programmable, networked, and diagnostically capable system.

The control laws used in induction-motor, permanent-magnet synchronous-motor, reluctance-motor, and dc drives are generally developed in continuous time. In the actual drive, however, currents and voltages are measured at discrete instants, calculations are performed using finite word lengths, and switching commands are issued after a non-zero computational delay. Consequently, the performance of a digital drive depends not only on the control theory but also on sampling frequency, discretisation method, processor architecture, interrupt scheduling, memory access, communication interfaces, and software quality.

This chapter examines the complete path from a continuous-time control design to a verified embedded implementation. Particular attention is given to sampling and reconstruction, discrete-time modelling, quantisation, computation delay, real-time scheduling, hardware selection, interfaces, hardware-in-the-loop testing, and software verification. These issues are especially important in high-performance drives, where a small timing error or poorly managed numerical effect can produce torque ripple, instability, excessive current, or unsafe operation.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Explain the architecture of a digitally controlled electrical drive.

2. Select suitable sampling, discretisation, and computation strategies for drive algorithms.

3. Analyse the effects of quantisation, delay, jitter, and finite computational resources.

4. Compare DSP, microcontroller, FPGA, and heterogeneous implementations.

5. Design a real-time task schedule and identify critical timing constraints.

6. Describe signal-conditioning, PWM, encoder, communication, and protection interfaces.

7. Apply hardware-in-the-loop methods to the development and verification of drives.

8. Establish verification, validation, safety, and configuration-management practices for embedded drive software.

From Continuous Control Law to Executable Algorithm

A digital drive typically contains four functional layers. The power converter applies switching actions to the motor. Sensors measure currents, dc-link voltage, rotor position, speed, and temperature. The embedded controller processes these measurements and generates modulation commands. A supervisory layer manages references, operating modes, faults, communications, and protection.

A simplified signal path is

\[

\text{reference} \rightarrow \text{outer controller} \rightarrow \text{current or torque controller} \rightarrow \text{PWM} \rightarrow \text{converter and motor}.

\]

Feedback signals pass through sensors, isolation circuits, anti-alias filters, analogue-to-digital converters (ADCs), and software scaling before entering the control algorithm. The controller output is converted into duty ratios or switching states by a space-vector modulator, carrier-based PWM routine, direct torque-control logic, or predictive control algorithm.

The continuous-time control law must be converted into a form that can be evaluated within a fixed execution interval. For a proportional-integral controller,

\[

u(t)=K_p e(t)+K_i\int e(t)dt,

\]

one practical discrete implementation is

\[

x[k]=x[k-1]+K_iT_s e[k],

\]

\[

u[k]=K_p e[k]+x[k],

\]

where \(T_s\) is the sampling period. In a practical implementation, the integrator must also include saturation and anti-windup logic. The command may be limited by the available dc-link voltage, current rating, modulation range, or operating mode.

The choice of discrete representation is not merely a programming detail. Forward Euler discretisation is simple but may introduce significant phase and gain errors when the sampling frequency is not sufficiently high. Backward Euler has better stability properties for some applications. The bilinear, or Tustin, transformation maps the stable continuous-time half-plane into the stable discrete-time unit circle and often provides a useful compromise for digital compensators. Exact zero-order-hold discretisation is valuable when a plant model is available and computational requirements permit its use.

For example, a first-order plant

\[

G(s)=\frac{K}{\tau s+1}

\]

can be represented under a zero-order hold by

\[

x[k+1]=a x[k]+b u[k],

\]

where \(a=e^{-T_s/\tau}\) and \(b=K(1-a)\). This form is particularly suitable for state-space control and observers.

Sampling, Reconstruction, and Synchronisation

Sampling frequency must be selected with reference to both the electrical dynamics and the switching process. The Nyquist condition states that a sampled signal must be sampled at more than twice its highest frequency to avoid spectral overlap. In a drive, this condition alone is inadequate because switching ripple, sensor noise, dead-time effects, and rapidly changing current transients may occupy frequencies well above the fundamental motor frequency.

Current controllers are often synchronised with the PWM carrier. Sampling at a defined point in the carrier period reduces variation caused by switching transitions. In a centre-aligned PWM system, sampling near the midpoint of a half-cycle can provide a relatively quiet measurement interval. The exact choice depends on converter topology, minimum pulse widths, blanking intervals, and the number of measurable phase currents.

An analogue anti-alias filter is normally placed before an ADC. It attenuates frequency components that would otherwise be folded into the control bandwidth. Excessive filtering, however, adds phase lag. The filter must therefore be designed together with the current-loop bandwidth and sampling frequency.

Sampling may be periodic, event-triggered, or asynchronous. Periodic sampling is predictable and well suited to current control. Event-triggered sampling can be useful in variable-frequency or protection applications but requires careful analysis of timing and observability. Asynchronous sampling of a PWM-driven current can create systematic measurement errors because the measured value depends on the switching state at the sampling instant.

A digital controller also requires reconstruction or output holding. Most PWM hardware acts as a zero-order hold: a calculated duty ratio remains constant until the next update. The combined effects of sampling, calculation, PWM update, and zero-order holding produce an effective delay that must be included in the control design.

Computation Delay, Jitter, and Real-Time Behaviour

In an ideal discrete controller, a measurement at instant \(kT_s\) would produce an actuator command at the same instant. Real systems require time for ADC conversion, data transfer, calculation, register updates, and PWM synchronization. If the command is applied one sample later, the delay is approximately \(T_s\), although the effective delay may be a fraction or multiple of the sampling period depending on the architecture.

A delay contributes phase lag. For a frequency \(\omega\), a delay \(T_d\) produces phase shift

\[

\phi_d=-\omega T_d.

\]

This reduces stability margin and limits achievable current-loop bandwidth. Delay compensation may involve predicting current, using a model-based observer, advancing the reference, or designing the controller with the delay explicitly included. Compensation should not be applied without considering parameter uncertainty and noise, because prediction errors can become significant at high speed or during transients.

Jitter is the variation in execution or sampling time from one cycle to another. Although the average sampling period may be correct, jitter causes variable phase delay and can create modulation sidebands, acoustic noise, and inconsistent current regulation. High-performance drives therefore use hardware-triggered ADCs, deterministic interrupts, direct memory access, and carefully bounded interrupt latency.

Real-time correctness has two dimensions. Functional correctness means that the algorithm produces the right numerical result. Temporal correctness means that the result is produced before its deadline and is applied at the intended point in the PWM cycle. A controller that is mathematically correct but misses its update deadline is an incorrect controller.

Quantisation and Numerical Representation

An ADC converts a continuous signal into a finite set of codes. For an ideal ADC with full-scale range \(V_{FS}\) and \(N\) bits, the nominal resolution is

\[

q=\frac{V_{FS}}{2^N}.

\]

Quantisation error is commonly modelled as a bounded error of approximately \(\pm q/2\), although real systems also exhibit offset, gain error, differential nonlinearity, integral nonlinearity, reference variation, and noise. Current-sensor offset is particularly important because it appears as a false torque-producing or flux-producing component in transformed coordinates.

Fixed-point processors represent numbers using a limited number of integer and fractional bits. Fixed-point arithmetic is fast and deterministic, but scaling must be designed carefully. Overflow in a coordinate transformation or integrator can cause catastrophic control failure. Saturation arithmetic is generally safer than wraparound arithmetic. Floating-point processors simplify dynamic-range management and algorithm development, but they do not remove the need to consider precision, execution time, exceptional values, and numerical conditioning.

The Clarke and Park transformations illustrate the importance of consistent numerical conventions. Whether the transformation is amplitude invariant or power invariant, and whether the electrical angle is defined with a particular sign convention, must be documented and applied consistently to measurement conversion, control equations, modulation, and commissioning tools.

Integral controllers require special treatment. If the actuator saturates while the integrator continues to accumulate error, the controller may take a long time to recover after the command returns within range. Conditional integration, back-calculation, or integrator clamping are standard anti-windup methods. Numerical limits should be tested explicitly, including zero speed, reverse rotation, maximum current, minimum dc-link voltage, and sensor disconnection.

Choosing the Embedded Platform

A DSP is designed for intensive numerical processing. Fast multiply-accumulate operations, specialized addressing modes, floating-point support, PWM peripherals, ADC triggering, and encoder interfaces make DSPs suitable for vector control and observers. A modern motor-control microcontroller combines similar numerical capability with integrated timers, ADCs, comparators, communication peripherals, and safety functions. It is often an economical choice for low- and medium-power drives.

An FPGA implements operations as spatial hardware rather than as a sequential instruction stream. Parallel execution enables extremely short and deterministic latency. FPGAs are valuable for very high switching frequencies, multichannel converters, custom modulation, high-resolution capture, and hardware-in-the-loop models. Their disadvantages include greater design complexity, more demanding verification, and the need to manage fixed-point pipelines and resource utilization.

A heterogeneous platform may use a microcontroller for supervisory and control tasks and an FPGA for high-speed acquisition, modulation, or protection. A system-on-chip may combine processor cores, programmable logic, memory, and communication interfaces. Platform selection should be based on control bandwidth, timing determinism, algorithm complexity, safety requirements, development tools, cost, power consumption, maintainability, and expected product life.

Embedded Software Architecture and Scheduling

A robust drive controller separates fast control functions from slower supervisory functions. A representative schedule is:

• PWM-synchronised interrupt: ADC acquisition, current scaling, coordinate transformation, current control, modulation, and PWM update.
• Medium-rate task: speed control, flux estimation, parameter adaptation, and thermal calculation.
• Slow task: state-machine management, diagnostics, communication, logging, and display services.
• Independent protection path: overcurrent, overvoltage, desaturation, overspeed, and emergency shutdown.

The fast interrupt should have bounded execution time. Dynamic memory allocation, unbounded loops, blocking communication calls, and extensive diagnostic printing should not occur in this path. A real-time operating system can provide task management, communication, and timing services, but its interrupt latency and scheduling overhead must be measured. A bare-metal superloop may be adequate for a simple drive, whereas a complex multi-axis system benefits from an RTOS or a carefully partitioned multicore architecture.

A state machine gives explicit meaning to operating modes such as initialization, ready, run, controlled stop, fault, and reset. Transitions should be governed by validated conditions rather than scattered Boolean flags. Fault handling must define which actions are immediate in hardware, which are performed by firmware, how gate signals are disabled, how energy is dissipated, and under what conditions restart is permitted.

Interfaces Between the Controller and the Drive

Analogue interfaces require signal conditioning, isolation where necessary, protection against overvoltage, and attention to common-mode transients. Current sensors may be shunts, Hall-effect devices, or fluxgate sensors. Their bandwidth, offset drift, propagation delay, and common-mode rejection affect control performance.

Digital position interfaces include incremental encoders, resolver-to-digital converters, Hall sensors, and absolute serial encoders. Position processing must account for index alignment, direction, electrical-mechanical pole-pair conversion, missing pulses, and wraparound. At high speed, capture hardware is preferable to software polling.

PWM interfaces must manage dead time, minimum pulse width, complementary outputs, fault blanking, and safe-state behaviour. Dead time prevents shoot-through but distorts the effective voltage, especially at low speed and low modulation index. Compensation may improve waveform quality but must be disabled or limited when current polarity is uncertain.

Communication interfaces such as CAN, industrial Ethernet, SPI, UART, and isolated fieldbuses support commissioning, coordination, and diagnostics. Communication data should not be allowed to overwrite safety-critical control variables without range checking, authentication where appropriate, and state-dependent permission. A command received through a network is an input to the safety architecture, not a substitute for it.

Hardware-in-the-Loop and Verification

Hardware-in-the-loop (HIL) testing connects the actual controller to a real-time simulation of the converter, motor, mechanical load, sensors, and faults. The simulated plant must execute faster than, or at least synchronously with, the controller’s time scale. HIL enables testing of start-up, speed reversal, load disturbances, sensor failures, dc-link faults, overcurrent events, and communication loss without exposing personnel or hardware to full energy.

A development workflow may proceed from model-in-the-loop (MIL), through software-in-the-loop (SIL), processor-in-the-loop (PIL), controller-HIL, and finally power-stage testing. MIL tests the control concept using a high-level model. SIL tests compiled control software against a simulated plant. PIL measures numerical and execution effects on the target processor. HIL tests real I/O timing and fault responses. Power-stage tests validate electromagnetic compatibility, thermal behaviour, insulation, switching stresses, and real sensor imperfections.

Verification asks whether the implementation satisfies specified requirements; validation asks whether the requirements and implementation meet the intended application. Requirements should be measurable, for example: current-loop execution shall complete within a specified fraction of the PWM period; an overcurrent input shall disable gate commands within a defined maximum time; speed error shall remain within a specified bound under a stated load disturbance.

Software verification techniques include code reviews, static analysis, unit tests, integration tests, boundary-value tests, fault injection, timing measurement, traceability matrices, and regression testing. Coding standards reduce risks associated with implicit type conversion, uninitialised variables, race conditions, and unreachable or duplicated logic. Configuration management is essential because a controller’s behaviour depends on source code, compiler settings, calibration constants, processor configuration, FPGA bitstream, and test data.

Illustrative Case Study: Digital Control of a Permanent-Magnet Motor Drive

Background

Consider an illustrative 15-kW permanent-magnet synchronous-motor drive for a conveyor application. The drive uses field-oriented control, a dc-link voltage of several hundred volts, a PWM frequency of 10 kHz, two phase-current measurements, and an incremental encoder. The controller must provide accurate low-speed torque and rapid fault response.

Situation and Problem

The first prototype exhibited oscillatory current at medium speed, occasional torque pulsation after load changes, and inconsistent fault timing. The continuous-time simulation was stable, and the nominal control gains appeared appropriate. The problem therefore required examination of the embedded implementation rather than only the controller equations.

Analysis

Oscilloscope measurements showed that ADC sampling was not consistently aligned with the PWM carrier. Some conversions occurred during switching transitions. The current-control computation sometimes missed the PWM update window because a diagnostic communication routine occupied the processor. In addition, the rotor-angle offset stored in nonvolatile memory had been calibrated using a different sign convention from that used in the Park transformation. The integral controller also accumulated error during voltage saturation at low dc-link voltage.

Approach and Solution

The development team introduced hardware-triggered ADC sampling at a defined carrier position and separated the fast current-control interrupt from communication processing. PWM updates were made double-buffered so that a new duty ratio could be applied only at a safe carrier boundary. The control design was retuned with the measured computation and PWM delay included.

The angle-calibration procedure was rewritten to state the mechanical-to-electrical conversion, positive direction, phase sequence, and transformation convention. Calibration data were checked for plausibility before being accepted. Anti-windup back-calculation was added to the voltage-limited current controller. Finally, controller-HIL tests were created for encoder reversal, sensor offset, dc-link sag, and delayed computation.

Outcome

The revised implementation removed the timing-related oscillation and made current-loop behaviour repeatable across operating points. The fault path was divided into a hardware gate-disable mechanism and a firmware diagnostic mechanism, ensuring that logging could not delay protection. The case demonstrates that digital-drive performance is determined by the combined control, hardware, timing, and software architecture.

Learning Points

A stable mathematical controller can fail when sampling is poorly synchronised, computation deadlines are missed, conventions are inconsistent, or saturation is ignored. Timing measurements, explicit interfaces, and staged verification are therefore as important as gain calculation.

Challenges, Risks, and Professional Considerations

Common implementation mistakes include selecting a sampling frequency without considering delay, assuming ADC readings represent instantaneous current, ignoring sensor offset, allowing integrator windup, using floating-point values without checking exceptional conditions, and placing protection entirely in software. Another frequent error is testing only nominal operating conditions. Boundary conditions—zero speed, maximum speed, weak dc-link voltage, rapid reversal, sensor failure, and communication interruption—often reveal the most serious defects.

Cybersecurity is increasingly relevant because networked drives may accept commands or firmware updates through industrial networks. Secure boot, authenticated updates, access control, logging, and network segmentation help protect the control system. Safety and cybersecurity should be considered together: an unauthorised command, corrupted calibration value, or compromised update can have physical consequences.

Professional practice also requires electromagnetic compatibility, electrical safety, functional safety, and compliance with applicable product and industrial standards. Specific standards depend on the product and jurisdiction, but the general principles are stable: hazards must be identified, protective functions must be independent where necessary, requirements must be traceable, and evidence of verification must be retained.

Emerging Directions and Best Practices

Embedded drive development is moving toward model-based design, automatic code generation with human review, multicore controllers, FPGA-based predictive control, high-resolution sensing, and edge analytics for condition monitoring. Machine-learning methods may assist fault diagnosis or parameter estimation, but safety-critical switching and protection functions should remain bounded, interpretable, and independently supervised.

Recommended practice includes the following:

• Define timing, numerical, safety, and performance requirements before coding.
• Synchronise ADC sampling and PWM updates using hardware whenever possible.
• Measure worst-case execution time, interrupt latency, and jitter on the target platform.
• Include computation delay, sensor dynamics, and quantisation in the control design.
• Use explicit scaling, saturation, range checks, and documented coordinate conventions.
• Separate fast control, supervision, communications, and protection functions.
• Test nominal, boundary, fault, and recovery conditions through MIL, SIL, PIL, HIL, and hardware tests.
• Maintain traceability between requirements, code, calibration data, and test evidence.

Chapter Summary

Digital control transforms electrical-drive algorithms into time-constrained embedded computations. Successful implementation requires coordinated treatment of sampling, anti-aliasing, discretisation, PWM reconstruction, computation delay, jitter, quantisation, scaling, and saturation. DSPs and microcontrollers provide efficient numerical control with integrated motor-control peripherals, whereas FPGAs offer highly parallel and deterministic execution; heterogeneous systems combine these strengths.

A practical drive uses synchronised acquisition, bounded real-time tasks, explicit state management, protected interfaces, and independent fault mechanisms. Hardware-in-the-loop testing and staged verification expose timing, numerical, interface, and fault-response problems before full-power testing. The central professional lesson is that a drive controller is a cyber-physical system: control equations, embedded software, electronics, power hardware, and safety processes must be designed and verified as one system.

Key Terms

Sampling period: Time interval between successive digital measurements or control updates.

Anti-alias filter: Analogue filter that attenuates frequency components above the usable sampling band.

Zero-order hold: Output mechanism that maintains a calculated command until the next update.

Discretisation: Conversion of a continuous-time model or controller into a discrete-time representation.

Quantisation: Representation of a continuous or high-resolution value by finite digital codes.

Fixed-point arithmetic: Numerical representation using predetermined integer and fractional bit fields.

Computation delay: Time between measurement acquisition and application of the corresponding control command.

Jitter: Variation in the nominal timing of sampling, execution, or output update.

Worst-case execution time: Maximum execution duration that a task can require under specified conditions.

DSP: Processor specialised for fast numerical and signal-processing operations.

FPGA: Programmable device that implements digital functions as configurable parallel hardware.

PWM: Technique for controlling converter average voltage through pulse duty ratios.

Dead time: Deliberate delay between complementary switch commands to prevent shoot-through.

Anti-windup: Method that prevents an integral controller from accumulating unusable error during saturation.

Hardware-in-the-loop: Testing method in which real control hardware interacts with a real-time simulated plant.

Model-in-the-loop: Testing of a control model against a simulated plant before embedded implementation.

Functional verification: Demonstration that an implementation satisfies specified requirements.

Validation: Determination that the system fulfils its intended application and operational purpose.

State machine: Formal representation of operating modes and permitted transitions.

Traceability: Documented relationship among requirements, implementation elements, and verification evidence.

Review Questions

Short Answer Questions

1. Why must PWM synchronisation be considered when selecting the ADC sampling instant?

2. What is the principal effect of computation delay on current-loop stability?

3. Distinguish fixed-point arithmetic from floating-point arithmetic in an embedded drive.

4. State two purposes of anti-windup protection.

5. What is the difference between verification and validation?

Long Answer Questions

1. Explain the complete signal path from a motor current sensor to the PWM output of a digitally controlled drive.

2. Discuss the effects of sampling, discretisation, zero-order holding, and computation delay on drive-control performance.

3. Compare DSPs, motor-control microcontrollers, FPGAs, and heterogeneous platforms for electrical-drive applications.

4. Describe a real-time software architecture for a vector-controlled drive, including fast, medium-rate, slow, and protection functions.

5. Explain how MIL, SIL, PIL, HIL, and power-stage testing can be combined into a verification strategy.

Analytical / Application Questions

1. A current controller executes correctly in simulation but occasionally misses its PWM update deadline in hardware. Analyse possible causes and propose an improved scheduling and interface architecture.

2. A drive shows torque ripple only at low speed and low dc-link voltage. Identify the likely roles of quantisation, sensor offset, dead time, voltage saturation, and integrator windup, and propose tests to separate them.

3. Select an embedded platform and verification approach for a high-switching-frequency, multi-axis drive requiring deterministic protection and networked supervision. Justify the trade-offs among computational performance, timing, cost, safety, and maintainability.

22. Multiple Choice Questions with Answers

Question 1

Which implementation effect most directly introduces phase lag that must be included in a high-bandwidth current-loop design?

A. A computation and PWM update delay

B. A larger encoder resolution

C. A lower motor pole-pair number

D. A wider communication data field

Correct Answer: A. A computation and PWM update delay

Question 2

Why is hardware-triggered ADC sampling commonly used in PWM-controlled drives?

A. To eliminate the need for signal conditioning

B. To ensure measurements occur at predictable points relative to switching

C. To increase the motor’s mechanical speed

D. To convert fixed-point arithmetic into floating point

Correct Answer: B. To ensure measurements occur at predictable points relative to switching

Question 3

A controller’s integrator continues accumulating error while the voltage command is saturated. What problem is most likely to result?

A. Aliasing

B. Dead-time cancellation

C. Integrator windup

D. Encoder quantisation elimination

Correct Answer: C. Integrator windup

Question 4

Which platform is most naturally suited to highly parallel, deterministic hardware pipelines?

A. FPGA

B. Analogue tachogenerator

C. Mechanical relay controller

D. Basic UART interface

Correct Answer: A. FPGA

Question 5

What is the main danger of wraparound arithmetic in a fixed-point drive controller?

A. It always reduces ADC bandwidth

B. A small overflow can become a large invalid control value

C. It prevents PWM synchronisation by definition

D. It automatically disables the converter

Correct Answer: B. A small overflow can become a large invalid control value

Question 6

Which task should normally receive the highest timing priority in a digitally controlled drive?

A. Display refresh

B. Diagnostic report formatting

C. PWM-synchronised current control

D. Noncritical data logging

Correct Answer: C. PWM-synchronised current control

Question 7

In the illustrative case, inconsistent current behaviour was partly caused by which interface problem?

A. ADC sampling occurred during unsuitable switching transitions

B. The motor had no mechanical load

C. The communication cable was too short

D. The controller used an excessively large memory

Correct Answer: A. ADC sampling occurred during unsuitable switching transitions

Question 8

What does processor-in-the-loop testing primarily reveal compared with a purely high-level simulation?

A. The exact insulation lifetime of the motor

B. Numerical and execution effects associated with the target processor

C. The final mechanical wear rate of bearings

D. The guaranteed electromagnetic compatibility of the product

Correct Answer: B. Numerical and execution effects associated with the target processor

Question 9

Which statement best distinguishes functional correctness from temporal correctness?

A. Functional correctness concerns numerical results; temporal correctness concerns meeting deadlines

B. Functional correctness concerns hardware colour; temporal correctness concerns software language

C. Functional correctness applies only to sensors; temporal correctness applies only to motors

D. They are identical terms with no engineering distinction

Correct Answer: A. Functional correctness concerns numerical results; temporal correctness concerns meeting deadlines

Question 10

Why should a network command not directly bypass the drive’s safety architecture?

A. Network commands cannot contain numerical values

B. A communication input may be invalid, unauthorised, or unsafe

C. Safety functions are needed only during factory testing

D. Network interfaces always operate faster than protection hardware

Correct Answer: B. A communication input may be invalid, unauthorised, or unsafe