Closed-Loop Actuator Control for Cochlear Surgery: Lessons from the Lab

I joined a PhD project at Brunel working on robot-assisted cochlear implant insertion. The brief was simple to state and humbling to implement: move a linear actuator slowly, smoothly, and predictably, because the patient is the load. Get the velocity wrong and you bruise the basilar membrane. Get the position wrong and the electrode array misses its target. Get the documentation wrong and the device never reaches a clinic.

The hardware loop

Actuonix L12 linear actuators driven by PWM from an Arduino, with the actuator's built-in potentiometer feeding analogue position back into MATLAB over serial. The control loop reads a target, samples actual position, computes error, and adjusts duty cycle. Trivial on paper. The interesting parts live in the corners.

// 10-bit ADC, 0..1023 maps to 0..50 mm stroke
float pos_mm = (analogRead(POT) / 1023.0f) * STROKE_MM;
float err   = target_mm - pos_mm;
float duty  = constrain(KP * err, -MAX_DUTY, MAX_DUTY);
analogWrite(PWM, 128 + (int)duty);

Why proportional alone is not enough

Pure P-control leaves you with a steady-state error proportional to the load. Add an integral term and you eliminate the offset but introduce windup if you saturate the actuator. PID is overkill for a slow electromechanical system with no meaningful disturbance, the derivative term just amplifies ADC noise. The honest answer for this rig was PI with an anti-windup clamp, plus a deadband around the target so the actuator doesn't hunt on the last bit of quantisation noise.

Sensor noise is the real adversary

The potentiometer reads cleanly when nothing is moving and jitters by 2–4 LSBs while the actuator drives. An exponential moving average with α≈0.2 cuts the jitter without adding noticeable lag at the sample rate we cared about. Bigger filters give smoother signals and bigger phase delay; phase delay is how a control loop turns into an oscillator. Pick the smallest filter that lets you meet the tolerance budget and stop.

Velocity is harder than position

Position is a setpoint. Velocity is the safety story. The cochlea tolerates insertion at roughly 0.1–0.4 mm/s; faster causes trauma. We investigated the current–resistance–velocity relationship empirically so the same actuator could be commanded to *travel* at a controlled speed rather than just *stop* at a controlled depth. That meant a second outer loop generating position setpoints along a velocity profile, with the inner PI loop tracking them.

Fail-safe defaults

The non-negotiables, baked into firmware before any feature work:

Watchdog timer resets the MCU if the main loop stalls

Loss of serial heartbeat halts the actuator within one control period

Out-of-range potentiometer readings (open circuit, short) trip a hard stop

Power-on state is *retracted and idle*, never mid-stroke

The ±2 mm tolerance budget

Tolerance is the contract between the mechanical, electrical, and software teams. ±2 mm sounds generous until you decompose it: ±0.3 mm of ADC quantisation, ±0.5 mm of mechanical backlash, ±0.4 mm of thermal drift on the pot, ±0.2 mm of control-loop overshoot, and suddenly software has ±0.6 mm to spend, not 2. Writing the budget down on day one is what stops the integration meeting from becoming a blame meeting.

Communicating across disciplines

Most of the team are not software engineers. UML activity diagrams of the control flow, state machines for the fault behaviour, and a one-page interface spec for the serial protocol turned out to be the most valuable artefacts I produced, more than the firmware itself. The mechanical engineer needs to know what happens when she unplugs the encoder. The surgeon needs to know that the device cannot run away. Neither of them is going to read your code.

Why this is a business story, not just an engineering one

Medical devices live under IEC 62304 (software lifecycle) and ISO 14971 (risk management). A Class B or C classification turns every undocumented assumption into a future audit finding. The cost of a clinical recall sits in the millions; the cost of a UML diagram sits in an afternoon. Investors and clinical partners read the *risk file*, not the codebase, and a clean risk file is what unlocks the next funding round or hospital partnership. Engineers who can produce both the firmware and the paperwork are disproportionately valuable, because they collapse a two-role pipeline into one.

Safety-critical code earns its name in the documentation, not just the binary. The artefact that ships to the regulator is the artefact that ships the product.