## 5 Implementation  
The control system is developed using Simulink according to Figure 4. In order to program the controller, the user has to include in the Simulink model the blocks related to hardware resources (i.e., input/output peripherals such analog to digital, digital to analog, serial ports) and configure it. First, the controller model is executed in the computer, using the embedded controller as an I/O device, while the outputs are stored to be used later in the validation stage. Then, the model is directly implemented in the embedded controller according to MBD and SIL-related directives [14]. Thanks to this methodology, checking the output between the control program running on the computer, or on the embedded controller, is easier than with the traditional handwriting programming methodology. Moreover, detecting embedded implementation, code generation, and compilation errors during debugging is easier. The described working methodology uses two MBD programs, the control model, and a data acquisition model. The data acquisition model runs only on the computer, and it is useful to acquire and show data from the USB interface of the embedded controller. In addition, this data acquisition program can be used to send data or orders to the embedded controller at execution time. Safety depends on both software and hardware implementation [13]. The embedded controller can be damaged either by a mechanical accident or by electrical problems. This situation needs to be considered to ensure the entire system's safety and reliability. Typically, the controller is optocoupled from the power stage, but the power stage must detect if the controller is still working. Damaged controllers can still produce an uncontrolled output signal to the power stage, potentially leading to a catastrophic situation. Not all the safety-related aspects of the embedded software can address scenarios such as this. To prevent this potentially dangerous situation in a human-like scenario, as presented in this paper, the power stage is equipped with a controller to maintain signal detection circuitry. Figure 7 shows the entire controller with the power stage scheme. The signal controller is complex because it needs a fixed frequency for the analog output signal. In this way, if the embedded controller is damaged or a system failure takes place, it avoids output failure. Figure 8 shows the Simulink scheme that runs on the PC, where all the variables required are displayed to the user through graphical scopes. Figure 9 shows the Simulink model transferred to the microcontroller, an STM32F407 with a floating-point unit from ST Microelectronics(r) manufacturer. It consists of the algorithm that performs the actions of the adaptive controller. This model is divided into four parts: first-order system, identifier, calculation of PID gains, and adaptive PID controller. It also contains a data output block for sending controller data through the microcontroller's USB port. The Simulink model intended for the embedded controller must contain a target setup block, represented in Figure 6 at the top right corner. This block specifies the code generation process, the hardware architecture, and other related stuff, such as MISRA C-compliant features, to generate and compile a program suitable for the selected embedded controller. The model works as the one described in Figure 5. Parameters are identified from the inputs and outputs of the system. These parameters are used to calculate the new regulator gains, and with those gains, the PID controller is modified to obtain a control action that meets the imposed specifications. However, when working with real systems, an initial period is required in order to obtain a first estimation of the parameters. Therefore, a conventional fixed-parameter PID controller is used in these first stages. It makes the system stable and allows for the proper identification of the plant parameters.