Digital Controller Realizations, Finite Precision & Runtime Semantics

Suppose

$$D(z)=\frac{b_0+b_1z^{-1}+\cdots+b_mz^{-m}}{1+a_1z^{-1}+\cdots+a_nz^{-n}}.$$

The corresponding difference equation is

$$u[k]=\sum_{i=0}^{m}b_i e[k-i]-\sum_{j=1}^{n}a_j u[k-j].$$

This equation assumes normalized $a_0=1$ and a specific denominator-sign convention. Libraries often store feedback coefficients with the opposite sign. A coefficient vector without its convention and sample period is unsafe to reuse.

Second-order sections localize coefficient sensitivity and state scaling. The internal states and signs shown by an API must match the design convention exactly.

Direct forms #

Direct Form I keeps separate delay lines for input and output histories. It uses more state but can offer useful fixed-point overflow properties depending on arithmetic and scaling.

Direct Form II shares one delay line and is canonical in state count, but internal states can have much larger dynamic range than input/output. Transposed Direct Form II reverses the signal-flow graph and is widely used for floating-point biquads because of its data flow and numerical behavior.

At infinite precision these realize the same rational function. At finite precision, rounding occurs at different locations, internal state ranges differ, and feedback of quantization error changes the result.

Cascade and parallel forms #

Factor a high-order controller into real first- and second-order sections:

$$D(z)=K\prod_{i=1}^{q}D_i(z).$$

Cascaded biquads reduce global coefficient sensitivity and permit per-section scaling. Pair poles and zeros deliberately; section order can affect internal peaks. Distribute overall gain to keep every state within range.

Parallel partial-fraction form sums lower-order branches. It can expose modal contributions and permit independent scaling, but near repeated poles or ill-conditioned residues can be problematic.

No factorization justifies cancelling an unstable or uncertain plant factor. These are controller realization choices after a valid controller has been synthesized.

State-space realization #

Implement

$$x_c[k+1]=A_cx_c[k]+B_ce[k],$$

$$u[k]=C_cx_c[k]+D_ce[k].$$

Similarity transformations preserve the ideal transfer function but change numerical conditioning and state range. Balanced or otherwise scaled coordinates can outperform controllable canonical form. State-space is also clearer for MIMO control, anti-windup augmentation, and explicit state transfer between controller versions.

Fixed-point design #

For every signal and operation specify:

• signedness, word length, and binary-point/scaling;
• coefficient format and quantization;
• multiplication result width and accumulator width;
• rounding mode at each cast;
• overflow behavior: wrap, saturate, or trap;
• state storage precision;
• bounds derived from plant/controller operation.

Wrapping overflow is a severe nonlinear sign/magnitude change. Saturating arithmetic avoids wrap but still changes the recurrence and can pin internal state. Both require nonlinear tests.

Quantize coefficients, recompute poles/zeros, and sweep nearby representable values. Then run a bit-true simulation of the entire closed loop. A stable double-precision controller can become unstable or develop a zero-input limit cycle after quantization.

Roundoff and limit cycles #

Recursive state feeds past quantization error forward. With zero input, rounding can settle into a periodic nonzero sequence. Deadband, dither, increased precision, alternative realization, or state flushing can change this behavior, but each has control consequences. Do not add one as an implicit fallback.

Test zero-input decay from many internal states, including values near half-LSB boundaries and saturation. Test constant small inputs and sign reversals to expose dead zones.

Runtime update must be atomic #

One control tick should conceptually:

1. acquire and validate the measurement with timestamp;
2. compute error/reference shaping;
3. read old controller states;
4. compute candidate output and new states under the defined recurrence;
5. apply saturation, rate, and anti-windup rules in defined order;
6. commit new states and actuator command atomically;
7. record timing and diagnostics.

If an interrupt or concurrent task can observe partially updated states, the implemented recurrence is time-varying and race-dependent. Use ownership or synchronization that preserves the tick boundary.

Saturation and anti-windup belong inside the realization #

Clamping only the final DAC code while leaving integral or recursive states unconstrained can create long recovery and overflow. Anti-windup tracks the actually applied command, not merely the pre-clamp candidate. Rate limiting adds another dynamic state. The order of clamp, rate limit, manual override, and feedback to controller state must match the analyzed architecture.

Hot swap, restart, and gain scheduling #

Two realizations of the same $D(z)$ have different state coordinates. Copying state arrays between them is meaningless without a mapping. For a controller change, use one approved mechanism:

• derive a state transformation when realizations are equivalent;
• solve for new state from recent input/output history;
• run the new controller in shadow until its output matches;
• initialize states to reproduce current applied output under explicit assumptions.

State reset is a visible mode transition, not a harmless default. Validate bumplessness and safety under plant motion.

Concrete biquad convention #

A transposed direct-form II section is commonly written

$$y[k]=b_0x[k]+d_1[k-1],$$

$$d_1[k]=b_1x[k]-a_1y[k]+d_2[k-1],$$

$$d_2[k]=b_2x[k]-a_2y[k].$$

Some APIs expect stored coefficients $(-a_1,-a_2)$ and use addition. ARM CMSIS-DSP explicitly warns that feedback coefficient signs may need negation depending on the design tool convention. Verify with impulse and step vectors before connecting an actuator.

Verification capsule #

1. Export coefficients with sample period, structure, section order, scale, and sign convention.
2. Compare design model and realization impulse responses in high precision.
3. Quantize and recalculate poles/zeros.
4. Run bit-true closed-loop tests for range, rounding, overflow, and limit cycles.
5. Measure worst-case execution time and deadline behavior on target hardware.
6. Exercise saturation, rate limiting, sensor faults, restart, and controller swap.
7. Compare target traces against a reference implementation sample by sample.

The realization is the controller. The transfer function is its infinite-precision specification.