How does a hobby ESC drive a BLDC motor?
Disclaimers


This post assumes the reader is roughly familiar with how the electromagnet and phase energization inside BLDC motors generates motion. I use the term "phase" rather interchangeably.
The actual control algorithm for sensorless control is beyond the scope of this post. I don't have a firm understanding of that yet.




Note regarding "AC" vs "DC" motors: technically, all motors are AC motors because an alternating current is required to switch the polarity of the electromagnets inside the motor and pull/push the rotor magnets to generate torque. 

A "brushed DC" motor is the only motor that will run when connected directly to DC power because a mechanical apparatus called a commutator will passively switch the direction of the current inside the magnet. The battery still sees a DC current (aka commutation). The dark/light blue rings in this gif are commutators. 

Every other motor, including brushless "DC" motors (BLDC), are now enemies of the Republic will not run when connected directly to a DC source as they require active commutation and some sort of speed or position feedback to control the commutation.



Overview: The drive train of a hobby aircraft typically consists of a battery (DC power source), an ESC (motor driver), and a brushless "DC" motor, aka BLDC motor (2-phase AC motor). The ESC provides two functions:


DC/AC inversion: six switches serve as PWM inverters that convert the DC power supplied by the battery into AC voltage for a motor.
Position sensing: 9 resistors (detailed paper) sense per-phase voltages (and indirectly rotor position &amp; speed) for the control algorithm.


Below is a diagram of the 6 switches (excluding zero-detection elements) that perform the core function of PWM inversion in an ESC:



PWM inversion and position sensing enable an ESC to correctly energize 2/3 phases of a BLDC motor to generate torque while using the 3rd phase for position and speed feedback without the use of an external sensor.



Key motor property: Back-EMF. The following model describes a BLDC motor's response to an applied voltage (\$V_a\$):

$$V_{a} = 2I_{a}R_{a} + E_{line-to-line} = 2I_{a}R_{a} + k_{e}\omega$$

Where voltage and current are per-phase peak values, \$[k_{e}] = V/\frac{rad}{s}\$, \$R_{a}\$ is the resistance of a single phase, and \$\omega\$ is the angular speed of the rotor in rad/s. 

As a motor spins faster, an increasingly greater "back-voltage" builds up inside the motor. This reverse potential is called back-EMF (E), and generators rely on this potential to convert mechanical energy into electrical energy. The speed at which \$E = V_a\$ defines the maximum electrical speed of the motor since the power source has lost the high ground can no longer force more voltage down the line. This electrical speed limit is typically above the mechanical speed limit from bearings, mechanical stresses, etc. Nevertheless, I think direct-drive torquers (see here for motors with \$k_e\$ > 2 N*m/A!) are actually limited by electrical speed since they have such large \$k_e\$ values (\$k_e = k_t = 1/k_v\$ with the right units).

BLDC ESCs "massage" rotor speed and position information out of the back-EMF voltage without the need of an external sensor for position feedback. This saves weight, power, and mechanical complexity.



PWM inversion: Depending on the user's throttle ratio (\$d\$), the ESC will use pulse-width-modulation (PWM) to generate a trapezoidal driving voltage of varying peak value (\$V_p = dV_{dc}\$) for the motor. This output PWM power signal (f is in the kHz) is completely different from the PWM (aka pulse "position" modulation) control signal (f = 50 Hz) that handles RC communication (more info on the latter). The PWM signals between the ESC and motor are much more fascinating.

Depending on the phase combination to be energized, the power PWM signal will:


"ramp up" the peak line-to-line voltage seen by the motor using ever-higher ON-times for the base pulses. This corresponds to the up-slope of the trapezoidal drive voltage. 
"hold" the peak voltage steady at the desired throttle setting (\$V_p = dV_{dc}\$). This corresponds to the flat-top of the drive trapezoid.
"ramp down" the peak voltage. This corresponds to the down-slope. 


See my rough annotation below (original image courtesy of this Q&amp;A on Robotics SE), and how gates will hold HI for increasingly longer periods of time (ramp up), hold HI for a long period (flat-top), and hold HI for decreasingly lower periods of time (ramp down). Negative energization just corresponds to different phase pairs.



Note, the duration of the flat-top region will increase/decrease as the motor speed decreases/increases because the ESC must energize pairs less/more frequently. In context of the PWM deep dive I cited earlier, this frequency change corresponds to a change in the PWM control frequency, not the more basic triangle wave frequency. The humble hobby ESC is a variable frequency drive!



Position sensing: Recall the back-EMF (E) generated by spinning motors. E "crawls back up all pipes" While the ESC energizes 2/3 phases. The instantaneous value of E depends on the rotor's position relative to an activated phase. If the rotor is instantaneously directly aligned with a phase, then e(t) is actually zero (no magnetic interactions).

If a phase isn't energized by the ESC's applied voltage, such as the 3rd phase or the other 2 phases when their drive circuits are open (OFF-time of PWM), then E is an opposing potential on those phases. If we measure E, then we can watch for when E crosses 0V. This zero-crossing corresponds to when the rotor passes a currently energized phase which indicates that the next set of electromagnets/phase combination should be energized (see gif).

However, there is a problem: the typical "wye" (Y) connection used in BLDC motors (pic below) doesn't have a neutral point, so what does the ESC actually measure back-EMF with respect to? The Y-midpoint isn't an output on most motors...



The solution is to create 3 "virtual center taps" with another set of wye-resistors for each pair of opposing MOSFETs on the ESC as pictured below. These virtual grounds can serve as reference points for measuring E because the sum of line-to-line voltages in a proper wye connection is always zero (see how the traffic doesn't stop in this nifty gif).


Now the ESC actually has a meaningful method with which to measure EMF and sense the position and speed of the rotor.