A Fault-Tolerant Finite-Control-Set MPC Architecture with Asymmetry-Aware Thermal Balancing for Switched Reluctance Motor Drives

Abstract

Switched reluctance motors (SRMs) are attractive for fault-tolerant drives because their rare-earth-free rotor and intrinsic phase isolation support continued operation after a converter fault. Realising this requires a post-fault control policy that preserves both torque tracking and per-phase thermal balance, with the latter being a safety-relevant design consideration motivated by—though not herein verified against—ISO 26262. This paper proposes and evaluates, by simulation, a three-layer fault-tolerant finite-control-set model predictive control (FCS-MPC) architecture for a four-phase 8/6 SRM under a single open-phase converter fault. The layers are (i) a vector-set reconfiguration from the eight healthy, active vectors to the twenty-six admissible post-fault vectors, which restores controllability of the reduced converter; (ii) soft commutation expressed as a position-dependent penalty inside the MPC cost; and (iii) asymmetry-aware balancing that evens out the accumulated thermal load across the three healthy phases. We additionally analyse an activated-on-demand max-penalty thermal limiter and show, both analytically and in simulation, that it shares its optimiser with the variance-based balancing term and therefore confers no measurable benefit over it; it is consequently retained only as an optional on-demand limiter rather than a separate layer. The architecture is benchmarked against a fault-blind baseline, a rule-based hard fault-tolerant reference (Hard-FT), and intermediate configurations through a deterministic ablation across three critical operating points, complemented by a robustness assessment under measurement noise and parameter mismatch. A six-criteria fault-tolerance scorecard is reported as a methodological observation on the transferability of healthy-mode SRM specifications to post-fault operation.

1. Introduction

Electrification of road transport has renewed industrial and academic interest in electric machines that are robust, inexpensive, and free of rare-earth magnets. Switched reluctance motors (SRMs) meet these three constraints and have re-emerged as a competitive option for traction, auxiliary, and ancillary drives in electric vehicles (EVs) [1,2,3,4]. Beyond their cost and material advantages, two structural properties make SRMs particularly suited to the fault-critical operation demanded by automotive safety standards such as ISO 26262 [5]: each stator phase is magnetically independent of the others, and the typical asymmetric H-bridge converter has two independent switches per phase, so a single switch failure does not disable the neighbouring phases. Fault-tolerant operation after the loss of one phase is therefore achievable in principle by re-routing the torque demand onto the remaining healthy phases [6,7,8]. For an EV drive, this structural property translates into a safety-relevant limp-home capability—provided the control policy running on the healthy phases preserves both torque production and per-phase thermal integrity.

In practice, the quality of the fault ride-through depends strongly on the control policy. A naive policy that continues to demand the pre-fault phase currents—the “fault-blind” baseline—leads to severe torque ripple, speed drop, and current spikes in the neighbouring phases because each healthy phase must cover a larger angular arc of the electromechanical torque profile. Classical fault-tolerant strategies address this through hard-switched compensation: torque reference re-allocation, commutation-angle shifts forced by rule-based logic, and current limits triggered by lookup tables [6,7,8]. We refer to this rule-based reference design as Hard-FT throughout the paper. Mutually coupled and multi-phase variants of the same principle have also been investigated in the literature [9].

Finite-control-set model predictive control (FCS-MPC) has become a popular alternative for SRM current control because it handles the non-linear flux–current–angle relationship natively through a discrete-time plant model and admits arbitrary cost weights [10,11,12,13]. Recent FCS-MPC contributions for SRMs have shown improvements in torque ripple, switching effort, and average-current tracking under healthy operation [14,15,16,17], including the authors’ optimized dual-phase excitation approach for the 8/6 SRM [18]; a broader review of predictive control for SRM drives is given in [19]. Extensions to fault-tolerant operation are fewer and more recent: the common pattern is to retain the healthy-mode vector set and cost function and add a separate rule-based fault-handling module on top [20,21]. This is functional but leaves three sources of performance loss on the table: (i) the vector set, itself, is wrong after the fault because the admissible post-fault set has 26 non-trivial states rather than 8; (ii) hard turn-on/turn-off angle overrides introduce discontinuous cost-function behaviour that defeats MPC smoothness; and (iii) even with a correct vector set, the three healthy phases do not naturally distribute the missing torque uniformly, so per-phase thermal integrity is not enforced. Beyond SRMs, open-phase fault-tolerant control has advanced rapidly for multi-phase PMSM drives, where recent methods have optimized copper loss and phase-current trajectories under open-phase operation [22,23]; those approaches exploit the sinusoidal multi-phase structure and do not transfer directly to the doubly salient SRM addressed here. Comprehensive treatments of fault-tolerant SRM drives are collected in recent reviews [24]. Other SRM fault modes—notably, stator interturn short circuits—are handled by dedicated diagnosis and fault-tolerant methods [25,26,27], which are complementary to the single open-phase converter fault considered here.

• Contributions.

We propose and evaluate, by simulation, a three-layer fault-tolerant FCS-MPC architecture for a four-phase 8/6 SRM under a single open-phase fault, assessed with a 30-seed Monte Carlo simulation under measurement noise and parameter mismatch. The architecture combines (i) vector-set reconfiguration with the 26 admissible post-fault vectors, (ii) soft commutation via a position-dependent cost-function penalty (replacing rule-based overrides), and (iii) asymmetry balance penalizing the variance of RMS currents across the three healthy phases. We additionally analyse an optional max-penalty thermal limiter and show it to be equivalent to layer (iii). We report two intermediate configurations as reference points: L2-MPC, which exposes only layers (i) and (ii), and L3-MPC, which adds layer (iii); the limiter is evaluated as L4-MPC. The paper’s specific contributions are summarized as follows:

• We introduce a three-layer fault-tolerant FCS-MPC architecture that restores post-fault speed regulation under a single open-phase fault, which is shown to be robust to measurement noise and $\pm 10\%$ parameter mismatch across three critical operating points, with the largest gains at high speed, where a fault-blind controller loses regulation entirely.
• An equivalence analysis of the max-penalty limiter is presented. We show both structurally and empirically that penalizing the maximum healthy-phase RMS current against a fixed threshold and penalizing the dispersion of currents both require a balanced-state minimizer, so the two coincide wherever the load can be balanced. A weight sweep and a 30-seed Monte Carlo simulation confirm that the limiter adds no measurable benefit at the studied threshold ($p=1.0$ on all twelve paired comparisons); it is therefore reported as an analysed equivalent rather than a separate layer.
• We report an ablation that isolates the contribution of each architectural layer at three operating points under nominal conditions, establishing that vector-set reconfiguration and soft commutation are the dominant contributors to tracking performance, while asymmetry balance adds a smaller but consistent improvement that is largest at low speed.
• We conduct a paired-seed Monte Carlo evaluation under measurement noise and parameter mismatch with Wilcoxon signed-rank tests [28] of the proposed controller against the fault-blind baseline and of the limiter variant against the balancing-only controller. The proposed-versus-blind speed-RMSE gain is significant at the mid- and high-speed operating points ($p<{10}^{-8}$ at 700/2 and 800/2 Nm) and only marginal at 400/2 Nm; the limiter-versus-balancing comparison is exact ($p=1.0$).
• We report a methodological observation on the strict scorecard: a six-criteria fault-tolerance scorecard, which is typical of healthy-mode SRM control, is not passed at any operating point by any controller under Monte Carlo simulation because post-fault torque ripple intrinsically exceeds the healthy-mode bound when a quarter of the excitation is lost. We interpret this as evidence that healthy-mode SRM specifications must be explicitly relaxed when transferred to post-fault operation—an observation relevant to ISO 26262-style certification of EV drives.

The remainder of the paper is organized as follows. Section 1.1 maps the three-layer architecture onto ISO 26262 safety concepts to make the certification relevance concrete. Section 2 describes the 8/6 SRM plant, the asymmetric bridge converter, the Le-Huy magnetization model, and the open-phase fault. Section 3 derives the three-layer fault-tolerant FCS-MPC architecture and its intermediate references (L2-MPC and L3-MPC), together with the analysed max-penalty limiter (L4-MPC). Section 4 describes the simulation methodology and fault-tolerance scorecard. Section 5 reports the results. Section 6 discusses implications. Section 7 concludes the paper.

1.1. ISO 26262 Context for Post-Fault SRM Drives

ISO 26262 governs the functional safety of electric and electronic systems in passenger vehicles [5]. Traction drives, on which vehicle propulsion and stability depend, are typically classified at Automotive Safety Integrity Level (ASIL) C or D, with the highest class assigned where unintended torque could lead to severe injury at high speed. We make explicit the distinction between the application context that motivates this work and the specific machine used to demonstrate it. The architecture, its cost-function formulation, and the ISO 26262 mapping developed below are framed for the EV-traction context because it is in traction that post-fault per-phase thermal integrity ceases to be a quality metric and becomes a quantified technical safety requirement (TSR-2, Section 1.1). However, the laboratory-scale four-phase 8/6 prototype used as the reference machine throughout this paper is a demonstrator whose most immediate realistic deployment is in auxiliary EV functions (Heating, Ventilation and Air Conditioning (HVAC); compressors; oil/coolant pumps; and e-axle accessories), which fall in the ASIL B–C range. The layered reasoning is identical in both cases; what changes when moving to a higher-ASIL traction drive is the tightness of the quantitative budgets (stricter thresholds), not the logical structure of the architecture.

1.1.1. Safety Goals (SGs) Addressable by the Layered Architecture

We identify three high-level safety goals to which post-fault SRM control directly contributes: (SG1) prevent unintended motor shutdown that would compromise vehicle controllability; (SG2) prevent phase-winding over-temperature that could lead to insulation failure or thermal runaway; (SG3) prevent uncontrolled torque ripple that would degrade vehicle drivability and exceed Noise, Vibration and Harshness (NVH) limits.

1.1.2. Technical Safety Requirements (TSR) Implemented per Layer

Each architectural layer implements one or more technical safety requirements derivable from the safety goals above:

• TSR-1 (from SG1): The drive shall continue producing the commanded average torque within a degraded-mode tolerance after a single open-phase converter fault. This requirement is implemented by Layers 1 and 2 (vector- reconfiguration and soft commutation).
• TSR-2 (from SG2): No healthy-phase RMS current shall exceed the rated thermal current ($I_{\mathrm{thermal}}$) during post-fault operation; RMS current bounds of this order for sustained operation are supported by thermal analyses of comparable SRM constructions [29]. In practice, the permissible continuous post-fault torque is ultimately gated by the winding temperature, typically measured by embedded sensors; the RMS-current bound used here is a control-accessible proxy for that thermal limit, not a substitute for temperature supervision. This requirement is addressed by Layer 3 (asymmetry balance), which equalizes healthy-phase loading; an optional max-penalty limiter targeting this requirement directly is analysed Section 3.6 and shown to coincide with Layer 3 wherever the load can be balanced.
• TSR-3 (from SG3): Post-fault torque ripple shall remain below an explicit fault-mode bound, distinct from the healthy-mode specification. This requirement is partially addressed by Layers 1–2 and discussed in Section 5.3: the simulation results motivate an explicit relaxation of the healthy-mode ripple specification for post-fault operation, since the standard 80% threshold is empirically infeasible under sensor noise and parameter mismatch.

1.1.3. Fault-Tolerant Time Interval (FTTI)

ISO 26262-3 defines the FTTI as the maximum interval between fault occurrence and the system reaching a safe state without violating any safety goal. For traction-class drives, the FTTI is typically in the range of 10–50 ms [5], dominated by the safe-state transition rather than fault detection itself. The lightweight residual-based detector Section 3.7 declares a phase faulty within two to three sampling periods (i.e., 20–30 μs at $T_{\mathrm{s}}=10$ μs), so the dominant component of the FTTI in the proposed architecture is the controller’s transient toward the re-distributed phase currents, which the Monte Carlo measurement window starts capturing 10 ms after fault onset (Section 4.3). We emphasize that the present work does not formally verify FTTI compliance: the 10 ms measurement-window offset is a conservative lower bound on the post-fault transient duration, not a measured time to the safe state. The post-fault metrics reported in this paper are therefore observed inside a typical traction FTTI budget, which is what makes the post-fault behaviour reported in Section 5.2 relevant to ISO 26262 argumentation within the simulation scope of this study.

1.1.4. Mapping the Layers onto ISO 26262 Concepts

Table 1. Roles of the three architectural layers and the analysed max-penalty limiter, mapped onto ISO 26262 concepts. Layers 1–2 implement the safe-state transition and degraded-mode torque production; Layer 3 balances healthy-phase thermal loading. The limiter is an analysed equivalent of Layer 3 (Section 3.6), not a separate functional layer.

Layer	ISO 26262 Concept	Evidence in This Paper
Layer 1 (vector-set reconfig.)	Safe-state transition; expanded admissible set after single-point fault	26-vector set restores controllability of the post-fault plant; dominant contributor to speed-RMSE reduction at the primary OP (Section 5.1)
Layer 2 (soft commutation)	Degraded-mode operation, smoothness preservation	Eliminates the fault-blind-vs-hard-FT NMSE/ripple inversion at 700–800 rpm (Section 5.1)
Layer 3 (asymmetry balance)	Degraded-mode thermal load sharing (TSR-2); tracking-quality refinement	Equalizes healthy-phase RMS current, reducing spread relative to L2-MPC, and restores speed regulation, mostly at low speed (Section 5.1 and  Section 5.2)
Max-penalty limiter (analysed equivalent)	Explicit per-phase thermal cap (TSR-2)	Shares the balanced-state minimizer with Layer 3; adds no measurable effect at the studied threshold of $p=1.0$ (Section 3.6 and  Section 5.2)

summarizes the correspondence. Layers 1 and 2 implement the safe-state transition and degraded-mode operation associated with TSR-1 (continued torque production); Layer 3 (asymmetry balance) equalizes healthy-phase loading and is the layer most directly associated with the per-phase thermal requirement (TSR-2). The optional max-penalty limiter targets TSR-2 explicitly but, as shown in Section 3.6, coincides with Layer 3 wherever the load can be balanced and is therefore reported as an analysed equivalent rather than a separate functional layer.

2. System Model and Open-Phase Fault Description

2.1. 8/6 SRM Plant

The machine under study is a four-phase 8/6 switched reluctance motor. The per-phase electrical dynamics are

$$v_k=R{i}_k+{\displaystyle \frac{d{\lambda }_k(\theta ,i_k)}{dt}},k\in \{A,B,C,D\},$$

(1)

where $v_k$, $i_k$, and ${\lambda }_k$ are phase voltage, phase current, and phase flux linkage; $\theta$ is the rotor’s mechanical angle; and R is the phase resistance. Because the phases are magnetically decoupled, the electromagnetic torque is the sum of the individual phase contributions:

$$T_{\mathrm{e}}(\theta ,\mathbf{i})={\displaystyle \sum _{k=A}^D}{T}_{\mathrm{e}}^{\left(k\right)}(\theta ,i_k),T_{\mathrm{e}}^{\left(k\right)}(\theta ,i)={\left.{\displaystyle \frac{\partial W_{\mathrm{co}}^{\left(k\right)}(\theta ,i^{\prime })}{\partial \theta }}\right|}_{i^{\prime }=i},$$

(2)

with $W_{\mathrm{co}}^{\left(k\right)}$ representing the co-energy of phase k. The mechanical equation is $J\dot{\omega }=T_{\mathrm{e}}-B\omega -T_L$, where $\omega$ is the mechanical angular velocity, J is the inertia, B is the viscous friction, and $T_L$ is the load torque.

The flux-linkage map (${\lambda }_k(\theta ,i_k)$) uses the piecewise Le-Huy model [30]:

$$\lambda (\theta ,i)=\left\{\begin{array}{cc}L\left(\theta \right)i,\hfill & i\le i_{\mathrm{sat}}\left(\theta \right),\hfill \\ L_{\mathrm{sat}}i+A\left(\theta \right)\left[1-e^{-\beta \left(\theta \right)(i-i_{\mathrm{sat}}\left(\theta \right))}\right],\hfill & i>i_{\mathrm{sat}}\left(\theta \right),\hfill \end{array}\right.$$

(3)

where $L\left(\theta \right)$ varies between the unaligned inductance ($L_u$) and the aligned inductance ($L_a$) $L_{\mathrm{sat}}$ is the deep-saturation slope, and $A\left(\theta \right)$ and $\beta \left(\theta \right)$ are angle-dependent fitting coefficients derived from the saturation flux (${\lambda }_M$). The inverse map ($i(\theta ,\lambda )$) and the analytical torque ($T_{\mathrm{e}}^{\left(k\right)}(\theta ,i)$) used in Equation (2) are precomputed on a fine $(\theta ,i)$ grid and stored as look-up tables.

Reference Machine

The numerical values used throughout this study correspond to a laboratory-scale four-phase 8/6 SRM prototype (Figure 1) that the authors used in earlier work on FCS-MPC for SRM drives [31]. The electrical parameters are a phase resistance of $R=3.1\Omega$, a DC-link voltage of $V_{\mathrm{dc}}=120$ V, and a maximum phase current of $I_{max}=10$ A. The Le-Huy magnetic parameters are an unsaturated (unaligned) inductance of $L_u=5.90$ mH, an aligned inductance of $L_a=23.60$ mH, a deep-saturation slope of $L_{\mathrm{sat}}=0.15$ mH, a saturation flux linkage of ${\lambda }_M=0.486$ Wb, and a saturation current of $i_{\mathrm{sat}}=10.0$ A at the aligned position. The mechanical parameters are a moment of inertia of $J=0.0032$ kg·m² and a viscous friction coefficient of $B=0.001$ N·m·s/rad. These values are summarized together with the controller weights in

Table 2. Plant and controller parameters of the reference laboratory prototype. The MPC sampling period is $T_{\mathrm{s}}=10$ μs throughout this paper.

Parameter	Symbol	Value
Number of phases/ stator–rotor poles	–	4/8–6
DC-link voltage	$V_{\mathrm{dc}}$	120 V
Phase resistance	R	3.1 $\Omega$
Maximum phase current	$I_{max}$	10 A
Unaligned (unsaturated) inductance	$L_u$	5.90 mH
Aligned inductance	$L_a$	23.60 mH
Saturation slope (Le-Huy)	$L_{\mathrm{sat}}$	0.15 mH
Saturation flux (Le-Huy)	${\lambda }_M$	0.486 Wb
Saturation current (aligned position)	$i_{\mathrm{sat}}$	10.0 A
Inertia	J	3.2 × ${10}^{-3}$ kg·m2
Viscous friction	B	1.0 × ${10}^{-3}$ N·m·s/rad
MPC sampling period	$T_{\mathrm{s}}$	10 μs
Simulation horizon	$T_{\mathrm{sim}}$	200 ms
Fault onset (nominal)	$t_f$	60 ms
Current soft limit	$I_{\lim }$	12 A
Rated phase RMS current (thermal)	$I_{\mathrm{thermal}}$	8.0 A
Torque-tracking weight	$W_T$	1.0
Current-limit weight	$W_I$	10.0
Switching-effort weight	$W_S$	0.1
Soft-commutation weight	$W_P$	5.0
Asymmetry-balance weight (variance)	$W_B$	2.0
Thermal-barrier weight (max)	$W_B^{max}$	5.0

.

The aligned inductance ($L_a=23.60$ mH) is the small-signal value at the aligned position measured at low current; magnetic saturation sets in above the saturation current ($i_{\mathrm{sat}}=10.0$ A) and is captured by the deep-saturation slope ($L_{\mathrm{sat}}$) and the saturation flux linkage (${\lambda }_M$) of the Le-Huy model. The machine is a laboratory-scale unit of the 500 W class with a rated speed of 1500 rpm (corresponding to a rated torque of approximately 3.2 N·m at rated power). The torque–speed envelope considered in this study spans 400–800 rpm and 1–3 N·m, i.e., below base speed in the constant-torque region, where post-fault torque redistribution across the healthy phases is most demanding. The Monte Carlo load of 2 N·m corresponds to roughly $60\%$ of rated torque, so the healthy phases retain magnetic and thermal headroom for partial compensation; full-load fault compensation is not claimed. The redundancy exploited here is specific to the four-phase topology—in a three-phase 6/4 machine, the loss of one phase removes a third of the excitation, and comparable compensation would be substantially harder.

2.2. Asymmetric Bridge Converter and Fault Model

Each phase k is driven by independent asymmetric H-bridge leg. The three switching states per phase are

$$s_k=\left\{\begin{array}{cc}+1\hfill & (\mathrm{both}\mathrm{switches}\mathrm{ON}:v_k=+V_{\mathrm{dc}}),\hfill \\ 0\hfill & (\mathrm{freewheel}:\mathrm{one}\mathrm{switch}\mathrm{ON},v_k\approx 0),\hfill \\ -1\hfill & (\mathrm{both}\mathrm{switches}\mathrm{OFF}:v_k=-V_{\mathrm{dc}},\mathrm{demagnetization}).\hfill \end{array}\right.$$

(4)

For a four-phase machine, this yields $3^4=81$ switching combinations in the healthy case, although the healthy FCS-MPC implementation used here evaluates eight single-phase-active vectors (one per phase with $s=+1$) plus the zero vector, which is a standard choice in SRM FCS-MPC [14].

Single Open-Phase Fault

We consider the loss of one converter leg at time $t=t_f$, modelled as an open circuit in phase $k^{★}\in \{A,B,C,D\}$. From $t_f$ onwards, the faulty phase current ($i_{k^{★}}$) is forced to zero, and $s_{k^{★}}$ is locked at zero, regardless of the controller command. This reduces the admissible vector set of the converter from $3^4$ to $3^3=27$ states, among which the 26 non-trivial states (excluding the all-zero vector) comprise the candidate MPC evaluation set after reconfiguration. This models the most restrictive failure (both switches of the leg lost and the phase current forced to zero). If only one switch or its gate drive fails, a zero-voltage freewheel loop through the complementary diode may remain physically available in the faulty phase, enlarging the admissible set beyond the 27 considered states; the 26-vector set used here is therefore the conservative worst case.

3. Proposed Fault-Tolerant FCS-MPC Architecture

3.1. Architectural Overview

The proposed controller combines a healthy-mode FCS-MPC core with three fault-reactive layers that activate upon detection of an open-phase fault (Figure 2). In healthy mode, the controller evaluates the eight active vectors plus zero, selecting the one that minimizes a cost function penalizing torque-tracking error, current excess, and switching effort. Upon fault detection at $t=t_f$ in phase $k^{★}$, three changes happen concurrently: the evaluation set expands to the 26 admissible post-fault vectors, a position-dependent penalty activates to implement soft commutation, and an asymmetry-balance term activates to penalize the dispersion of RMS currents across the three healthy phases. The three layers reshape the cost landscape continuously. We additionally analyse an optional max-penalty limiter that would engage only if the largest healthy-phase RMS current exceeded a rated thermal threshold ($I_{\mathrm{thermal}}$); Section 3.6 shows that this limiter shares its minimizer with the asymmetry-balance layer and is therefore redundant in the operating range studied here. It is reported as an analysed, equivalent alternative rather than as a fourth functional layer and is evaluated in the ablation under the L4-MPC label.

3.2. FCS-MPC Core and Prediction Model

At each sampling instant, the one-step-ahead prediction is

$${\widehat{\lambda }}_k[n+1]={\lambda }_k\left[n\right]+T_{\mathrm{s}}\left(s_k{V}_{\mathrm{dc}}-R{i}_k\left[n\right]\right),{\widehat{i}}_k[n+1]=i\left(\theta [n+1],{\widehat{\lambda }}_k[n+1]\right),$$

(5)

and the predicted electromagnetic torque ($\widehat{T_{\mathrm{e}}}[n+1]$) is evaluated through Equation (2) using the Le-Huy-based analytical-phase torque table. The cost function for a candidate vector ($\mathbf{s}\in \mathcal{V}$) is

$$J\left(\mathbf{s}\right)=W_T{e}_T\left(\mathbf{s}\right)+W_I{e}_I\left(\mathbf{s}\right)+W_S{e}_S\left(\mathbf{s}\right)+\underset{\mathrm{soft}\mathrm{commutation}}{\underbrace{W_P{e}_P\left(\mathbf{s}\right)}}+\underset{\mathrm{asymmetry}\mathrm{balance}}{\underbrace{W_B{e}_B\left(\mathbf{s}\right)}}+\underset{\mathrm{thermal}\mathrm{barrier}}{\underbrace{W_B^{max}{e}_B^{max}\left(\mathbf{s}\right)}},$$

(6)

where $e_T={(\widehat{T_{\mathrm{e}}}-T_{\mathrm{e}}^{*})}^2$ is the squared torque-tracking error, $e_I={\sum }_{k}max{(0,{\widehat{i}}_k-I_{\lim })}^2$ is the current-limit excess, $e_S$ counts per-leg switching transitions relative to the previous command, and the three fault-mode terms ($e_P,e_B$, and $e_B^{max}$) are gated by weights $(W_P,W_B$, and $W_B^{max}$) that are non-zero only after $t_f$. Weights are listed in Table 2.

3.3. Layer 1: Vector-Set Reconfiguration

In healthy mode, the controller evaluates the eight active vectors (${\mathcal{V}}_0$) plus the zero vector. After the fault in phase $k^{★}$, the admissible set becomes

$${\mathcal{V}}_{k^{★}}=\{\mathbf{s}\in {\{-1,0,+1\}}^4:s_{k^{★}}=0\}\setminus \left\{\mathbf{0}\right\},\left|{\mathcal{V}}_{k^{★}}\right|=26.$$

(7)

${\mathcal{V}}_{k^{★}}$ contains vectors with two or three simultaneously active phases, which are needed in the intervals where only one healthy phase would otherwise carry the torque demand and saturate its current. It also exposes the $-1$ demagnetization option in the healthy phases explicitly, so the optimizer can choose active demagnetization at phase commutation.

3.4. Layer 2: Soft Commutation via Position-Dependent Penalty

Classical fault-tolerant strategies superimpose hard turn-on/turn-off angle limits on the current controller: phase k is allowed to proceed only if ${\theta }_{\mathrm{on}}^{\left(k\right)}\le {\theta }_k\le {\theta }_{\mathrm{off}}^{\left(k\right)}$, and the switch command is clamped to $s_k=0$ outside that window. This introduces a discontinuity at the window edges and tends to produce audible torque spikes at commutation. The soft-commutation layer instead expresses the window as a quadratic cost penalty applied only to the healthy phases ($k\ne k^{★}$):

$$e_P\left(\mathbf{s}\right)=\sum _{k\ne k^{★}}{\varphi }_k\left(\theta \right)·{\widehat{i}}_k^2[n+1],{\varphi }_k\left(\theta \right)=\left\{\begin{array}{cc}0,\hfill & {\theta }_{\mathrm{on}}^{\left(k\right)}\le {\theta }_k\le {\theta }_{\mathrm{off}}^{\left(k\right)},\hfill \\ {\alpha }_k\left(\theta \right),\hfill & \mathrm{otherwise},\hfill \end{array}\right.$$

(8)

where ${\alpha }_k\left(\theta \right)\in [0,1]$ is a linear hinge function rising from zero at the conduction-window edge to unity at a user-specified saturation distance of 5° electrical past the window edge. The 5° value is electrical, not mechanical. For the 8/6 SRM considered here, the rotor pole pitch is $\pi /N_r={60}^{°}$ mechanical, so 5° electrical corresponds to ≈0.83° mechanical. A wider hinge would smooth the post-window transition further but at the cost of admitting more negative-torque-producing states during the falling-inductance region. The weight of $W_P=5.0$ is obtained from prior Bayesian optimization work on the same machine [31] and kept fixed so the present paper isolates the effect of placing the commutation knowledge inside versus on top of the MPC cost function.

3.5. Layer 3: Asymmetry Balance Across Healthy Phases

When one phase is lost, the three healthy phases must, together, supply the entire torque. Without awareness of the per-phase thermal limit, the phase angularly adjacent to the faulty one tends to absorb a disproportionate share of the torque burden. Layer 3 penalizes this imbalance by adding the variance of the windowed RMS currents across the three healthy phases to the MPC cost:

$$e_B\left(\mathbf{s}\right)={\mathrm{Var}}_{k\ne k^{★}}\left(I_k^{\mathrm{rms}}\right)={\displaystyle \frac{1}{3}}\sum _{k\ne k^{★}}{\left(I_k^{\mathrm{rms}}-{\overline{I}}^{\mathrm{rms}}\right)}^2,$$

(9)

where ${\overline{I}}^{\mathrm{rms}}$ is the mean of the three healthy-phase windowed RMS currents computed on a sliding window of one electrical stroke. $I_k^{\mathrm{rms}}$ is an internal controller state updated recursively. The weight of $W_B=2.0$ is obtained from earlier Bayesian optimization work [31].

A natural question is whether penalizing the dispersion of the healthy-phase currents, as in Equation (9), differs in effect from penalizing their maximum directly. This is the subject of the following subsection, which shows the two coincide wherever the load can be balanced.

3.6. Thermally Aware Load Balancing and the Max-Penalty Limiter

Minimizing the dispersion penalty ($e_B$) of Equation (9) drives the three healthy phases toward equal accumulated thermal loading, as tracked by an exponentially weighted moving average (EWMA) of the squared phase current whose square root is the per-phase RMS proxy used by the controller.

An Optional On-Demand Limiter and Why It Is Redundant

A natural alternative is to penalize the maximum healthy-phase RMS directly, activating only above a thermal threshold ($I_{\mathrm{th}}$, equal to the rated current of $I_{\mathrm{thermal}}=8.0$ A in Table 2 in the deployed controller and deliberately lowered in the sensitivity study reported in

Table 3. Effect of the max-penalty weight ($W_B^{max}$) at 400 rpm/3 Nm (noise-free; $I_{\mathrm{th}}=2.0$ A; $W_B^{max}=0$ recovers L3-MPC). The limiter is active here yet nearly inert: a $100\times$ weight increase changes every metric by <1%.

${\mathit{W}}_{\mathit{B}}^{max}$	${\mathit{I}}_{\mathbf{rms},\mathbf{healthy}}^{max}$ [A]	Torque NMSE	Ripple [%]
0 (L3-MPC)	3.134	0.439	65.38
1	3.134	0.439	65.38
2	3.132	0.439	65.34
5	3.132	0.439	65.34
10	3.132	0.439	65.34
20	3.130	0.438	65.28
50	3.126	0.438	65.26
100	3.119	0.436	65.11

):

$$e_B^{max}={\left[{max}_{k\in \mathcal{H}}\sqrt{{\widehat{ı}}_k^2}-I_{\mathrm{th}}\right]}_{+}^2,$$

(10)

corresponding to a one-sided quadratic hinge (${[·]}_{+}=max(·,0)$) that is exactly zero below $I_{\mathrm{th}}$. We include it for completeness but show that it confers no measurable benefit Equation (9) for a structural reason. For a fixed total healthy-phase loading of $S={\sum }_{k\in \mathcal{H}}{\widehat{ı}}_k^2$ imposed by the torque demand, the dispersion objective Equation (9) and the peak objective Equation (10) share the same minimizer—the balanced state (${\widehat{ı}}_k^2=S/\left|\mathcal{H}\right|$), which simultaneously zeroes the variance and minimizes the maximum. Wherever the controller can balance the load, the two penalties coincide; they can differ only below $I_{\mathrm{th}}$, where Equation (10) is dormant Equation (9) continues to act.

This is borne out quantitatively.

Table 4. Ablation across three operating points: single seed; no sensor noise; and phase A opened at $t_f=60$ ms, and $T_{\mathrm{s}}=10$ μs. Best value per row in bold. The Healthy column is the no-fault 8-vector baseline (fault never injected) and serves as the pre-fault reference; at 800 rpm, it already approaches the machine’s high-speed tracking limit. At these three operating points, the thermal barrier (L4-MPC) is dormant: ${max}_k{I}_k^{\mathrm{rms}}$ never exceeds $I_{\mathrm{thermal}}=8.0$ A, so L4-MPC reproduces L3-MPC with numerical precision—the designed behaviour of an activated-on-demand barrier.

OP [rpm/Nm]	Metric	Healthy	Fault-Blind	Hard-FT	L2-MPC	L3-MPC	L4-MPC
400/2	Speed RMSE [rad/s]	0.096	1.563	0.827	0.671	0.667	0.667
	NMSE	0.002	1.106	0.721	0.522	0.518	0.522
	Ripple [%]	3.83	103.02	83.13	70.48	70.21	70.48
	$I_{\mathrm{rms},\mathrm{healthy}}^{max}$ [A]	1.414	2.652	2.365	2.450	2.400	2.450
700/2	Speed RMSE [rad/s]	0.259	1.578	1.358	0.715	0.712	0.715
	NMSE	0.028	0.773	1.030	0.688	0.681	0.688
	Ripple [%]	14.95	89.08	99.97	78.91	78.55	78.91
	$I_{\mathrm{rms},\mathrm{healthy}}^{max}$ [A]	1.790	3.254	2.525	2.273	2.261	2.273
800/2	Speed RMSE [rad/s]	6.344	10.368	3.724	3.651	3.635	3.651
	NMSE	0.088	0.765	1.661	1.131	1.136	1.131
	Ripple [%]	20.87	84.03	113.72	91.34	91.38	91.34
	$I_{\mathrm{rms},\mathrm{healthy}}^{max}$ [A]	2.704	3.123	3.846	2.642	2.606	2.642

shows that the limiter (L4-MPC variant) reproduces the balancing layer (L3-MPC) to within ≤0.004 A on the healthy-phase RMS current at every operating point—identical to three decimal places wherever the limiter is dormant. A weight sweep at the most demanding unsaturated point (400 rpm/3 Nm, where the proxy is ≈3.13 A $>I_{\mathrm{th}}$ so the limiter is active) confirms it (Table 3): increasing $W_B^{max}$ over two orders of magnitude reduces the worst-phase RMS by only $0.5\%$ ($3.134\to 3.119$ A) and changes torque-tracking NMSE and ripple by less than $0.5\%$. Sweeping the threshold ($I_{\mathrm{th}}$) leaves the achieved RMS essentially invariant ($3.13$ A across $I_{\mathrm{th}}\in [1.5,4.0]$ A): the healthy-phase current is fixed by the torque the speed loop must deliver, and the limiter cannot reduce it below that level without sacrificing torque. We therefore retain the dispersion penalty (9) as the operative thermal-balancing mechanism and report (10) only as an analysed, equivalent alternative; the architecture comprises three functional layers.

3.7. Fault Detection and Mode Transition

A lightweight fault-detection layer is included so the evaluation is end-to-end. Detection is based on the residual between the healthy-model prediction and the measured phase current: if $|{\widehat{i}}_k-i_k|>{\delta }_{\det }$ persists for more than $n_{\det }$ consecutive steps in a single phase, that phase is declared faulty, and the three architectural layers activate. In all reported simulations, detection occurs within two to three sampling periods of the fault onset.

4. Simulation Methodology

All experiments were conducted in a reproducible Python3.11.15 simulation framework with checkpointed batch execution (intermediate per-seed results are persisted to disk so that interrupted batches can resume without recomputation). The plant is simulated with the Le-Huy flux-linkage model using the parameters reported in Table 2. Sensor noise and parameter perturbations are injected between the plant and the controller through hook functions, so the controller source is never modified between runs.

4.1. Controller Variants

Four fault-mode variants and one healthy reference are compared (

Table 5. Controller variants compared in this study. “26v” denotes the reconfigured vector set Equation (7).

Variant	Vector Set	Commutation	Soft Cost (${\mathit{W}}_{\mathit{P}}$)	Asym. Var. (${\mathit{W}}_{\mathit{B}}$)	Thermal Barrier (${\mathit{W}}_{\mathit{B}}^{max}$)
Healthy	8v	Intrinsic	Off	Off	Off
Fault-blind	8v	Rule-based	Off	Off	Off
Hard-FT	26v	Hard override	Off	Off	Off
L2-MPC	26v	Soft (Equation (8))	On	Off	Off
L3-MPC	26v	Soft (Equation (8))	On	On	Off
L4-MPC	26v	Soft (Equation (8))	On	On	On (Equation (10))

). Successive rows differ in exactly one architectural element, enabling the ablation reported in Section 5.1.

The Fault-blind baseline is the most pessimistic reference: it keeps the healthy-mode eight-vector set and the healthy-mode cost function after the fault. The Hard-FT variant corresponds to the Stephens-style reference [6,7]: the vector set is reconfigured to ${\mathcal{V}}_{k^{★}}$, but commutation is enforced by zeroing the switch command outside the window. The three-layered variants differ in the asymmetry treatment: L2-MPC has none, L3-MPC adds the variance-based asymmetry balance (Layer 3), and L4-MPC adds the optional max-penalty limiter of Equation (10) on top of Layer 3. L3-MPC is the proposed three-layer controller; L4-MPC is used to evaluate the limiter, which Section 3.6 shows to be equivalent to Layer 3 in the studied regime.

4.2. Operating Points, Fault Scenarios, and Perturbations

Three critical operating points $\left\{\right(400,2),(700,2),(800,2\left)\right\}$ (rpm, Nm), spanning low, mid, and high speed at the 2 Nm rated load, are used for both the nominal ablation and the Monte Carlo robustness campaign.

The fault is a single open circuit of phase $k^{★}$ triggered at $t_f=60$ ms. Sensor noise measurement-only: zero-mean Gaussian noise is added to the controller’s current reading at 3% of the full-scale current (${\sigma }_i=0.3$ A RMS) and to the rotor-position reading at ${\sigma }_{\theta }=1^{°}$ RMS, while the plant integrates the true state. For parameter mismatch, each seed draws multiplicative factors ($m_R,m_J$, and $m_B$) from $\mathrm{Unif}(0.9,1.1)$, applied to the plant resistance, inertia, and friction; the controller predicts using the nominal values, so the perturbation represents a mismatch between the plant and the controller’s internal model.

All Monte Carlo runs use $N_{\mathrm{seeds}}=30$. The robustness campaign of Section 5.2 evaluates the five fault-mode variants at the three critical operating points, totalling $5\times 3\times 30=450$ runs.

4.3. Metrics

Six metrics are computed on a measurement window starting 10 ms after fault onset (to exclude the detection transient) and ending at $T_{\mathrm{sim}}$: Speed RMSE [rad/s] is the RMS error of $\omega$ against the constant speed reference; torque RMS ripple [%] is the RMS of $T_{\mathrm{e}}-\overline{T_{\mathrm{e}}}$ normalized by $\overline{T_{\mathrm{e}}}$, times 100); torque-tracking NMSE is $\langle {(T_{\mathrm{e}}-T_{\mathrm{e}}^{*})}^2\rangle /\langle {T_{\mathrm{e}}^{*}}^2\rangle$), peak phase current is $I_{\mathrm{peak}}$ [A], i.e., the max of $|i_k|$ across healthy phases and time; healthy-phase RMS current is $I_{\mathrm{rms},\mathrm{healthy}}^{max}$ [A], i.e., the max over the three healthy phases of their RMS current in the measurement window); and mean torque is $\overline{T_{\mathrm{e}}}$ [Nm], i.e., the time-averaged torque, used as a tracking sanity check. Per-step MPC execution-time percentiles ($\{P_{50},P_{95}$, and $P_{99},max\}$) are also logged.

4.4. Fault-Tolerance Scorecard

A drive is said to tolerate the fault at a given operating point when it meets the six criteria of

Table 6. The six scorecard criteria. All six must be met simultaneously for a run to be declared fault-tolerant at an operating point.

Criterion	Threshold
Speed tracking	Speed RMSE < 5% of the reference speed
Torque tracking	NMSE < 0.25
Peak-current safety	$I_{\mathrm{peak}}\le$ 1.5 · rated phase current
Thermal safety	$I_{\mathrm{rms},\mathrm{healthy}}^{max}\le$ 1.2 · rated phase RMS current
Ripple	Torque RMS ripple < 80%
No runaway	Mean torque ≥ 0.8 · load torque

simultaneously in the measurement window. The scorecard produces a score in the range of $\{0,1,\dots ,6\}$ per run; a run is fully compliant if its score is 6.

Threshold Derivation

The six thresholds in Table 6 are taken from healthy-mode SRM control practice, with the following justifications. The 5%-of-reference speed-tracking budget follows from EV drivability practice, where speed deviations of 2–5% are at the threshold of driver perception during steady cruising; above this band, drivetrain noise and longitudinal jerk become noticeable. The 0.25 NMSE cap follows from the same drivability considerations expressed as a torque-tracking ratio. The peak-current limit at $1.5\times$ rated provides the customary $50\%$ semiconductor margin used in asymmetric-bridge SRM designs [2,3]. The thermal limit at $1.2\times$ rated phase RMS corresponds to the short-time over-current tolerance of insulation class F and class H windings under IEC 60034-1 [32] and is the certification-relevant constraint mapped to TSR-2 in Section 1.1. The 80% ripple threshold is a healthy-mode aspiration in the SRM literature [15,16]; we note in Section 5.3 that this threshold is empirically infeasible during a post-fault transient, and we explicitly recommend relaxation to a fault-mode bound as part of the paper’s contribution. The no-runaway criterion ($\overline{T_{\mathrm{e}}}\ge 0.8T_L$) is included as an implicit composite check that screens out controllers that appear to satisfy the thermal criterion only by under-producing torque; this matters for the under-tracking artefact discussed in Section 6.2.

4.5. Statistical Testing

Paired comparisons use the Wilcoxon signed-rank test [28] on per-seed metric values at each OP (scipy.stats.wilcoxon [33]). Seeds are matched, so each pair shares the same noise realization and parameter draw. We report the W statistic, two-sided p-value, and significance at $\alpha =0.01$. Three OPs × four primary metrics yield 12 paired tests within each comparison family (e.g., L3-MPC vs. Fault-blind, L4-MPC vs. Fault-blind, and L4-MPC vs. L3-MPC), each treated independently. The Bonferroni-corrected threshold within a family of 12 tests is ${\alpha }_B=0.01/12\approx 8.3\times {10}^{-4}$, used consistently in the significance testing of Section 5. A less conservative alternative, the Holm step-down procedure [34], would relax this floor at the cost of greater interpretive complexity; we report the Bonferroni threshold for transparency.

A note on terminology. We use the absence of a significant Wilcoxon result ($p>\alpha$) as evidence against the presence of a detectable difference at the achieved sample size, not as evidence for statistical equivalence. Formal equivalence testing requires the Two One-Sided Tests (TOST) procedure [35] with pre-specified equivalence margins on each metric (e.g., $\pm 0.5$ rad/s on speed RMSE, $\pm 0.1$ on NMSE, $\pm 0.2$ A on $I_{\mathrm{rms},\mathrm{healthy}}^{max}$, and $\pm 5$ percentage points on torque ripple). Where the present paper reports “no detectable difference” between L4-MPC and L3-MPC, we mean this in the absence-of-evidence sense and do not claim formal equivalence.

5. Results

This section presents the simulation-based evaluation of the proposed three-layer architecture. The evaluation is organized as follows. Section 5.1 reports the nominal ablation at three operating points (single seed, no sensor noise) to isolate the contribution of each architectural layer under ideal conditions. Section 5.2 reports the 30-seed Monte Carlo robustness campaign at the three critical operating points under measurement noise and $\pm 10\%$ parameter mismatch, with paired-seed Wilcoxon significance tests against the fault-blind baseline and the empirical confirmation that the max-penalty limiter (variant L4-MPC) is exactly equivalent to the asymmetry-balancing controller (L3-MPC) in this regime. Section 5.3 reports the scorecard pass rate. Section 5.4 reports algorithmic complexity and the reference Python implementation timing as a complexity indicator.

5.1. Nominal Ablation Across Three Operating Points

Table 4 reports the four fault-mode variants at three operating points with a single seed and no sensor noise. Successive columns add one architectural layer at a time, so the column-wise differences quantify the individual contributions, as shown in the (Figure 3).

At the primary operating point (400 rpm/2 Nm), the ablation is clean. The transition from Fault-blind to Hard-FT bundles vector-set reconfiguration with a rule-based commutation override (cf., Table 5), so the 47% speed-RMSE reduction (1.56 → 0.83 rad/s) attributable to that transition reflects the joint effect of these two changes rather than vector-set reconfiguration in isolation; the further reduction of Hard-FT → L2-MPC (19%, 0.83→ 0.67 rad/s) isolates the contribution of soft commutation alone. The asymmetry balance (L2-MPC → L3-MPC) adds a further 0.5% (0.671 → 0.667). The same pattern holds for NMSE (53% cumulative reduction, with asymmetry balance contributing 0.7%) and for ripple (31.8% cumulative, 0.4% from asymmetry balance).

At 700 rpm/2 Nm, a counter-intuitive feature appears: Hard-FT is worse than the Fault-blind baseline on NMSE (1.03 vs. 0.77) and on ripple (100% vs. 89%) because the hard turn-off override forces premature demagnetization in the expanded vector set. The soft-commutation layer then recovers the loss (Hard-FT → L2-MPC reduces NMSE by 33% and ripple by 21%). This is the clearest evidence in the ablation that placing the commutation logic inside the MPC cost function (rather than on top of it) is the right architectural choice at mid-to-high speeds. Asymmetry balance, again, contributes less than 1% to every metric, including a 0.5% reduction in $I_{\mathrm{rms},\mathrm{healthy}}^{max}$ (2.273 → 2.261 A) at this OP.

At 800 rpm/2 Nm, the Fault-blind baseline reports a speed RMSE of 10.37 rad/s—a tracking failure—but the lowest NMSE of all four variants. This is the first appearance of an artefact that recurs in the Monte Carlo results: a controller that fails to track the load reference produces an artificially low NMSE simply because $\widehat{T_{\mathrm{e}}}$ collapses toward zero, along with $T_{\mathrm{e}}^{*}$. The mean torque ($\overline{T_{\mathrm{e}}}$) at 800/2 (omitted from Table 4 for space) confirms partial torque collapse under Fault-blind, while the three expanded-set variants produce stronger torque and incur higher NMSE values in absolute terms. We discuss this under-tracking artefact and its consequences for thermal-metric interpretation once in Section 6.2.

In summary, the ablation establishes three findings: (i) the dominant contributions come from the joint vector-set reconfiguration plus soft-commutation pair, not asymmetry balance; (ii) tracking metrics alone can be misleading under torque under-production; and (iii) the thermal barrier is dormant under nominal conditions (L4-MPC ≡ L3-MPC to numerical precision), as designed.

5.2. Robustness Under Measurement Noise and Parameter Mismatch

The nominal ablation isolates each layer’s contribution but uses a single noise-free seed. To assess robustness, we run a Monte Carlo campaign at the three critical operating points (400/2, 700/2, and 800/2 Nm) with independent seeds each. Two perturbations are applied per seed and held paired across variants: measurement-only sensor noise, in which the controller reads a corrupted current (${\sigma }_i=0.3$ A, $3\%$ of $I_{max}$) and position (${\sigma }_{\theta }=1^{°}$) while the plant integrates the true state, and a $\pm 10\%$ perturbation of the plant resistance, inertia, and friction (R, J, and B), with the controller predicting using the nominal R. The fault is applied at $t_f=60$ ms, and metrics are computed over $[t_f+10\mathrm{ms},T_{\mathrm{sim}}]$. Five variants are reported: Fault-blind; Hard-FT; and the cumulative MPC variants, i.e., L2-MPC, L3-MPC, and L4-MPC.

5.2.1. Fault Tolerance Restores Speed Regulation

Across all three operating points, the proposed controller restores speed regulation relative to the Fault-blind baseline (

Table 7. Monte Carlo robustness under measurement noise and $\pm 10\%$ parameter mismatch (30 seeds per cell, reported as the mean). Single open-phase fault, phase A opened at $t_f=60$ ms, and $T_{\mathrm{s}}=10$μs. L4-MPC and L3-MPC are statistically identical at every operating point (paired Wilcoxon, $p=1.0$; Table 8); the L4-MPC row equals L3-MPC and is omitted. Hard-FT is retained as a cautionary reference.

OP [rpm/Nm]	Variant	Speed RMSE [rad /s]	Ripple [%]	${\mathit{I}}_{\mathbf{pk}}$ [A]	$\overline{{\mathit{T}}_{\mathbf{e}}}$ [Nm]
400/2	Fault-blind	1.57	102.9	12.19	2.041
	Hard-FT	0.84	83.8	10.55	2.042
	L2-MPC	1.59	83.1	11.25	2.055
	L3-MPC	1.25	78.0	10.97	2.062
700/2	Fault-blind	2.49	81.5	8.81	2.109
	Hard-FT	1.65	110.6	9.85	2.058
	L2-MPC	0.69	79.2	7.93	2.050
	L3-MPC	0.69	78.7	7.89	2.049
800/2	Fault-blind	12.61	81.1	8.79	2.120
	Hard-FT	4.85	110.9	14.20	2.413
	L2-MPC	2.53	95.0	9.56	2.355
	L3-MPC	2.53	95.4	9.58	2.357

). The improvement is modest at low speed (400 rpm/2 Nm: $1.25$ vs. $1.57$ rad/s) and pronounced at high speed, where the Fault-blind controller loses regulation entirely (800 rpm/2 Nm: $2.53$ vs. $12.61$ rad/s). Paired Wilcoxon signed-rank tests of L3-MPC against Fault-blind on matched seeds ($N=30$) confirm that the speed-RMSE gain is significant at the two higher-speed operating points ($p<{10}^{-8}$ at both 700/2 and 800/2 Nm), where the Fault-blind baseline loses regulation; at 400/2 Nm, where the improvement is modest, the gain is only marginal ($p=0.014$, significant at $\alpha =0.05$ but not at the $\alpha =0.01$ threshold used here).

5.2.2. Asymmetry Balance Helps Most at Low Speed

The asymmetry-aware layer (L3-MPC) matches or improves on the balancing-free variant (L2-MPC) and never degrades it. The clearest margin is at 400 rpm/2 Nm, where L2-MPC alone barely separates from the Fault-blind baseline on speed RMSE ($1.59$ vs. $1.57$ rad/s) while L3-MPC reaches $1.25$ rad/s; at 700 and 800 rpm, the two converge (≈0.69 and ≈2.53 rad/s, respectively). L3-MPC ripple is at or below L2-MPC at every point.

5.2.3. The Max-Penalty Limiter Is Exactly Equivalent Here

With $I_{\mathrm{th}}=8$ A, the limiter never binds: the largest healthy-phase RMS current the proposed controller draws anywhere in the campaign is $3.2$ A. As a result, L4-MPC reproduces L3-MPC exactly. All twelve paired Wilcoxon comparisons (four metrics × three operating points return $p=1.0$, with per-seed means identical to twelve significant figures (

Table 8. Paired Wilcoxon signed-rank tests (L4-MPC vs. L3-MPC) on matched seeds ($N=30$). With the limiter dormant at $I_{\mathrm{th}}=8$ A, the two controllers are bit-identical at every operating point and for every metric.

OP [rpm/Nm]	Metrics (Speed RMSE, NMSE, Ripple, and ${\mathit{I}}_{\mathbf{rms},\mathbf{healthy}}^{max}$)	p-Value
400/2	all identical	1.000
700/2	all identical	1.000
800/2	all identical	1.000

). This is the empirical counterpart of the structural equivalence of Section 3.6: wherever the healthy phases can be balanced, penalizing dispersion and penalizing the maximum coincide.

5.2.4. Limitations of the Robustness Campaign

Three caveats accompany these results see (Figure 4). First, the absolute torque ripple is high (78–$110\%$) because a single open-phase fault in a four-phase machine removes a quarter of the available excitation; this is intrinsic to the fault, not a controller artefact. At high speed, the fault-tolerant variants exhibit higher ripple than Fault-blind (≈95% vs. $81\%$ at 800/2 Nm) because the Fault-blind controller under-produces torque while the proposed controller pushes to maintain it—a trade of increased ripple for restored regulation, not a ripple reduction. Second, the Hard-FT baseline is the least favourable on both counts: it raises ripple to ≈110% and drives peak current to $14.2$ A (against the 15 A peak-current limit, $1.5\times$ rated) at 800 rpm, which motivates the soft-commutation and balancing layers rather than a rule-based override. Third, the $\pm 10\%$ parameter mismatch drives peak current above the 10 A nominal thresholdat low speed (up to $12.2$ A for Fault-blind and $11.0$ A for L3-MPC at 400/2 Nm), entering mild magnetic saturation while operation remains stable; this is the expected consequence of predicting with a nominal model under a de-rated plant and bounds the current margin a deployment would need to allow.

5.3. Scorecard Pass Rate Under Monte Carlo

Applying the healthy-mode fault-tolerance scorecard of Table 6 to the robustness campaign of Section 5.2 shows that its six criteria cannot be passed simultaneously during a post-fault transient under the tested uncertainty, for any variant. The binding constraints are the speed-regulation criterion—the $5\%$-of-reference band is routinely exceeded once $3\%$ current noise is injected—and, decisively, the $80\%$ ripple criterion: post-fault ripple sits between $78\%$ and $110\%$ at every tested operating point (Table 7), so the ripple criterion alone precludes an all-pass outcome. The healthy-phase RMS-current criterion, by contrast, is comfortably met—the largest healthy-phase RMS current the proposed controller draws across the campaign is $3.2$ A, against the 8 A rated threshold.

We interpret this not as a controller failure but as evidence that the thresholds of Table 6—typical of healthy-mode SRM control [6,8]—are too strict to pass simultaneously under sensor noise and parameter mismatch during a post-fault transient, when a quarter of the machine’s excitation is unavailable. post-fault-specific scorecard with relaxed ripple and speed bands is the appropriate evaluation instrument; its calibration is left to future work, alongside hardware validation. The implications for ISO 26262 post-fault certification are discussed in Section 6.

5.4. Algorithmic Complexity and Computational Cost

5.4.1. Algorithmic Complexity (FLOP Count per MPC Step)

The post-fault MPC step evaluates $|{\mathcal{V}}_{k^{★}}|=26$ candidate vectors. Each candidate evaluation comprises four phase predictions through Equation (5) (each requiring two multiplies and one add for the flux update, then a bilinear interpolation in the $i(\theta ,\lambda )$ table costing approximately eight FLOPs), one electromagnetic-torque evaluation through Equation (2) (a four-phase summation of bilinear interpolations in the $T_{\mathrm{e}}^{\left(k\right)}(\theta ,i)$ tables ≈36 FLOPs in total), and a cost evaluation summing the six terms in Equation (6) (≈12 FLOPs). Therefore, the per-candidate budget is $4·(3+8)+36+12\approx$ 92 FLOPs, yielding $26·92\approx 2400$ FLOPs per MPC step for the full post-fault evaluation. The healthy-mode eight-vector evaluation is proportionally smaller, at ≈740 FLOPs per step.

5.4.2. Reference Python Timing

Table 9. Per-step MPC execution-time percentiles in microseconds for L3-MPC at the three critical operating points for a reference Python implementation on a Colab CPU runtime, aggregated across 30 seeds per OP, reported as a complexity indicator for the simulation framework.

rpm	Load [Nm]	${\mathit{P}}_{50}$	${\mathit{P}}_{95}$	${\mathit{P}}_{99}$	max
400	2	1864.1	3682.9	4547.1	10,341.4
700	2	1830.7	3616.9	4427.7	10,679.1
800	2	1808.6	3557.1	4347.8	13,547.6

reports per-step MPC execution-time percentiles of the reference Python implementation on a Colab CPU runtime, aggregated across 30 seeds at each operating point. These values are not real-time measurements: $P_{99}$ exceeds $T_{\mathrm{s}}=10$ μs by roughly a factor of 450 (i.e., $P_{99}\approx 4.5$ ms, while $T_{\mathrm{s}}=10$ μs), reflecting Python interpreter overhead in Colab rather than the algorithmic cost of evaluating 26 candidate vectors. The distribution is informative as a complexity indicator: $P_{50}$ is roughly constant at 1.8–1.9 ms across the operating points, showing that operating-point-dependent branching does not meaningfully affect the average case; $P_{99}/P_{50}\approx 2.4$ is consistent with a fixed work budget plus interpreter-level variability. A compiled implementation (e.g., the Numba JIT acceleration we used in an earlier study, which gave a ∼50× speed-up on a closely related SRM simulator [31]) would reduce these timings by an order of magnitude or more, but compiled-runtime real-time validation is outside the scope of this simulation-based study.

6. Discussion

6.1. Where the Architectural Contributions Come from

Viewed across the ablation (Table 4) and the Monte Carlo robustness campaign (Table 7), the three layers contribute on distinct axes. Layers 1 and 2 drive tracking performance; Layer 3 (asymmetry balance) adds a smaller but consistent improvement, which is largest at low speed, and equalizes healthy-phase thermal loading. The optional max-penalty limiter targets the per-phase thermal cap directly but coincides with Layer 3 wherever the load can be (Section 3.6).

6.1.1. Vector-Set Reconfiguration Plus Soft Commutation Do the Heavy Lifting

The transition from the 8-vector healthy set to the 26-vector post-fault admissible set, taken together with the move from rule-based to in-cost commutation, accounts for the bulk of the speed-RMSE reduction at 400 rpm/2 Nm in the nominal ablation (Fault-blind → L2-MPC: 1.56 → 0.67 rad/s, a 57% reduction) and continues to dominate the Fault-blind-to-L2-MPC improvement under Monte Carlo simulation at every OP. This is consistent with the observation that the post-fault plant admits a larger admissible set than the healthy plant; the optimizer exploits the extra degrees of freedom only when the commutation window is not used to discard them.

6.1.2. Soft Commutation Matters Most at Mid-to-High Speed

At 700 rpm/2 Nm and 800 rpm/2 Nm, the Hard-FT variant is worse than the Fault-blind baseline on NMSE and ripple: the rule-based turn-off override forces premature demagnetization that the Fault-blind dispatch avoids. Soft commutation recovers most of this difference and, at 700/2 Nm, reduces NMSE by 33% and ripple by 21% over Hard-FT. This is the clearest evidence in the paper that placing the commutation logic inside the MPC cost function is the right architectural choice—a cautionary observation that may help explain the operating-point-specific performance variability reported in prior FCS-MPC fault- work [20,21], which combines reconfiguration with rule-based commutation.

6.1.3. Dispersion Versus Maximum: Why the Limiter Is Redundant

The asymmetry-balance penalty of Equation (9) equalizes the accumulated loading of the three healthy phases. A natural concern is that equalizing dispersion need not bound the maximum: a controller could equalize the phases while pushing all of them toward the thermal limit. This motivates the explicit max-penalty limiter of Equation (10). As shown in Section 3.6, however, the two objectives share the balanced-state minimizer whenever the load can be balanced, so the limiter is redundant wherever it would act. The robustness campaign confirms this directly: with $I_{\mathrm{th}}=8$ A, the limiter never binds (the largest healthy-phase RMS current the proposed controller draws is $3.2$ A), and L4-MPC reproduces L3-MPC exactly—all twelve paired Wilcoxon comparisons return $p=1.0$. We therefore report the limiter as an analysed, equivalent alternative and frame the per-phase thermal bound as safety-oriented motivation only; no thermal-compliance guarantee or fault-tolerant time-interval budget is claimed.

6.2. Torque Under-Delivery and Ripple Interpretation

One interpretive caution applies to the high-speed results. At 800 rpm/2 Nm, the Fault-blind baseline reports the lowest torque ripple of any variant ($81\%$, Table 7) despite the largest speed RMSE by a wide margin ($12.6$ rad/s). The low ripple is not evidence of good fault-tolerant behaviour: it reflects a baseline that has partially surrendered speed regulation, so its torque trajectory is smoother simply because it tracks the demand less aggressively. Therefore, torque ripple should be read alongside speed RMSE and mean torque rather than in isolation; the fault-tolerant variants accept higher ripple as the cost of holding speed regulation under the fault. The same caution applies to the healthy-phase RMS current, which is monotone in delivered torque to the first order: a controller that under-delivers torque also draws less current, so absolute current levels are comparable only between controllers that deliver matched mean torque.

6.3. Implications of the Scorecard Outcome

The absence of an all-pass scorecard outcome under Monte Carlo simulation (Section 5.3) reflects the binding of the speed-RMSE and ripple budgets under realistic uncertainty, not a thermal failure: the healthy-phase RMS-current criterion is the most-often-passed of the six. Read literally, healthy-mode SRM control specifications cannot all be preserved during a post-fault transient under sensor noise and parameter mismatch. The fault-tolerant SRM literature reports post-fault specifications evaluated mostly under nominal conditions [6,7,8]. Two practical responses follow: explicit relaxation of fault-mode thresholds (e.g., a 15–20% speed-RMSE budget and a 150% ripple budget during the post-fault transient) or reporting of per-criterion pass-rates rather than the six-way intersection. We recommend the first as language for future post-fault SRM evaluation.

6.4. Scope and Threats to Validity

The scope of this study should be made explicit. First, all results are simulation-based: the plant is modelled with the Le-Huy flux-linkage map identified from a laboratory-prototype reference, sensor noise is injected synthetically, and parameter mismatch is sampled from a uniform ±10% box around the nominal value. Therefore, the findings are claims about the controller architecture under these modelling assumptions and not measurements on a physical drive. Second, the controller weights ($W_P$, $W_B$, and $W_B^{max}$) are fixed at values obtained from earlier Bayesian optimization work [31] at a single OP or from the load-balancing analysis Section 3.6; per-OP gain scheduling is outside the scope of this paper. Third, the limiter threshold of $I_{\mathrm{th}}=8.0$ A coincides with the simulated machine’s rated phase RMS current and lies below $I_{max}=10$ A; because the limiter remained dormant at this threshold throughout the campaign (the largest healthy-phase RMS current drawn by the proposed controller was $3.2$ A), the present data do not quantify how its activation frequency and the associated tracking penalty would scale as $I_{\mathrm{th}}$ is reduced toward the sustained thermal rating. Fourth, the robustness perturbations are synthetic and a conservative lower bound on real measurement variability; truly independent runs with varied winding temperatures, mechanical wear, and component ageing would likely exhibit greater distributional shift. Fifth, the compute-time measurements in Table 9 reflect Python interpreter overhead and Colab host variability and should be read only as a complexity indicator, not as a real-time budget. Sixth, the scorecard criteria of Table 6 are a synthesis of healthy-mode SRM control practice and were not adjusted for post-fault operation, as discussed in Section 5.3. Seventh, the scope is restricted to single open-phase converter faults: multi-phase faults and short-circuit faults are not addressed by the cost-function formulation considered here. Eighth, the plant model treats the four phases as magnetically decoupled (Equation (1)); real SRMs exhibit weak inter-phase mutual coupling that is most pronounced near the aligned position, which is not captured here and which would modestly redistribute the post-fault healthy-phase currents.

7. Conclusions

This paper proposed and systematically evaluated, by simulation, a three-layer fault-tolerant FCS-MPC architecture for a four-phase 8/6 SRM under single open-phase faults, motivated by the use of SRMs in EV traction, where per-phase thermal integrity after a fault is a hard certification requirement. The architecture combines vector-set reconfiguration ($8\to 26$ active vectors), soft commutation via a position-dependent cost-function penalty, and variance-based asymmetry balance across the three healthy phases; an explicit max-penalty thermal limiter is analysed as an equivalent alternative rather than a separate layer.

Within the simulation study, the explicit max-penalty thermal limiter was found to be equivalent to the variance-based balancing term: for a fixed healthy-phase loading, the two penalties share the balanced-state optimiser, and a noise-free sweep across the three critical operating points confirmed that the limiter reproduces the variance-based controller to within ≤0.004 A on the worst healthy-phase RMS current, with a two-order-of-magnitude change in its weight altering torque ripple by less than $1\%$. Under the 30-seed Monte Carlo configurationthe two controllers were statistically identical at every operating point ($p=1.0$ on all paired comparisons). Therefore, the limiter is reported as an analysed, equivalent alternative rather than a distinct performance layer, and the architecture comprises three functional layers. We frame the per-phase thermal bound as safety-oriented motivation only; no fault-tolerant time-interval budget or ISO 26262 compliance is claimed.

The deterministic nominal ablation confirms a monotonic improvement at the primary operating point (400 rpm/2 Nm): speed RMSE drops from 1.56 rad/s (Fault-blind) to 0.67 rad/s for the full controller. The combination of vector-set reconfiguration and the move from rule-based to in-cost commutation accounts for the majority of this gain; asymmetry-aware balancing adds a smaller but consistent improvement and evens the loading of the healthy phases. At 700 rpm/2 Nm, rule-based hard commutation is worse than the Fault-blind baseline in NMSE and ripple, while soft commutation recovers this loss, supporting the choice of placing commutation knowledge inside the MPC cost function.

Under a 30-seed Monte Carlo simulationwith measurement-only sensor noise and $\pm 10\%$ parameter mismatch, the proposed controller restores post-fault speed regulation at every operating point—markedly so at high speed, where the fault-blind baseline loses regulation entirely (speed RMSE $2.5$ vs. $12.6$ rad/s at 800 rpm/2 Nm; paired Wilcoxon $p<{10}^{-8}$). A strict six-criterion scorecard is not met at any operating point, which we interpret as evidence that healthy-mode SRM specifications must be explicitly relaxed for post-fault operation. All findings are simulation-based and anchored to a laboratory-measured machine model; hardware validation of the post-fault converter behaviour is the natural next step.