Chapter 03 · Dynamics and feedback
Today in the field story
One problem, then the next
During the original Cold-Storage Door Tuning failure, the command stayed at its maximum while hidden integral state continued growing. Record requested and applied output separately, compare an unprotected integrator with conditional integration, and inspect the response after the simulated obstruction disappears. The clamp limits one output; anti-windup changes the memory that would otherwise prolong the wrong demand.
- Why now
The week needs a controlled failure that proves command limits and controller state are different safety concerns.
- Ignore today
Ignore claims of certified stopping; a software clamp is only one tested boundary.
- Unlocks next
A saturation and recovery metric that belongs in the final acceptance report.
Understand
Build the physical picture first
Saturation is a robot saying “I cannot deliver more.” Anti-windup stops the controller's memory from continuing to demand an impossible command while that limit is active.
A software controller can calculate any number, but a real actuator has a finite safe command range. Saturation maps the requested output to that range: a request of 11 with limits [-5,5] becomes an applied command of 5. The controller must log both values so saturation is visible rather than silently hidden.
Integral windup occurs when error continues to accumulate while the actuator is saturated and cannot produce the requested response. When the target changes or the mechanism finally becomes free, the stored integral keeps commanding in the old direction, causing slow recovery or overshoot.
Common anti-windup approaches include limiting the integral contribution, integrating only when the output is not saturated or when the error would move it out of saturation, and feeding the difference between requested and applied command back into the integral state. Each method must be tested at entry to and recovery from the limit.
A controller clamp is not the whole robot safety system. Hardware current limits, joint limits, velocity limits, collision checks, watchdogs, emergency stop, and risk assessment serve different purposes. Never use a tuning experiment to discover a physical safety boundary on an unprotected powered mechanism.
Words you need
Name each idea precisely
- Saturation
The applied command has reached a configured or physical limit.
Physical example:A request for 14 V is limited to the available safe 12 V or lower configured bound.
- Clamping
Bounding a value to a minimum and maximum.
Physical example:clamp(11,-5,5) returns 5.
- Integral windup
Excess stored error accumulated while the actuator cannot deliver the requested command.
Physical example:A stalled lift keeps storing upward error and surges after the obstruction clears.
- Anti-windup
A rule that limits or corrects integral state during saturation.
Physical example:Pause integration when the output is at its upper limit and positive error would push it higher.
- Command authority
The actual range of physical effect the actuator can safely produce.
Physical example:A steering motor has enough torque for an empty rover but not for a jammed wheel.
Math, one line at a time
Work through today’s relationship
Prerequisite rescue · optionalChange over time and feedback
Velocity, acceleration, and control error explain whether a robot settles, overshoots, or becomes unsafe.
- Δx/Δt
- change in position divided by elapsed timeUnit: metres per second (m/s)
- e = target − measured
- control errorUnit: same unit as the target
- u
- bounded actuator commandUnit: device-specific
A wheel moves from 1 m to 1.6 m in 0.2 s, so Δx = 0.6 m.
Average velocity is 0.6/0.2 = 3 m/s.
If the target is 2 m and measured position is 1.6 m, error e = 0.4 m; a controller converts that error into a limited command.
A feedback loop resembles an event loop that checks state repeatedly, but a missed deadline changes physical motion, not just screen responsiveness.
Position changes by 0.5 m in 0.25 s. What is average velocity?
0.5/0.25 = 2 m/s.
Clamp the requested command to the actuator range:
Without anti-windup, this saturated step still adds
to the integral state.
Compare a wound-up integrator with conditional integration
A simulated PID requests u=11, the safe command range is [-5,5], error e=3, sample time Δt=0.1 s, and the current integral state is 1.0 error·s.
Clamp the request: u_applied=5 and record saturation=true.
Without protection, compute added integral error: eΔt=3×0.1=0.3 error·s.
The unprotected integral state becomes 1.3 error·s even though no extra command can be applied.
For conditional integration, notice that positive error would push farther above the upper limit.
Pause that integral update, leaving the protected state at 1.0 error·s.
When the error becomes negative, allow integration because it helps move the request back inside the limit.
Both controllers apply 5 now, but only the unprotected controller stores an additional 0.3 error·s that can delay later recovery.
Anti-windup changes hidden controller state, so test what happens after saturation ends—not only the command while it is clamped.
Physical examples
Where this appears in real life
Blocked drawer
Imagine continuing to pull harder on a drawer already held by a physical stop, then storing every extra pull as a future instruction.
The stop prevents more motion now; replaying the stored effort after release would be the dangerous windup analogy.
Hill-limited rover
A rover asks for more wheel effort on a slope until its configured current limit is reached.
Tracking error can remain even with maximum applied command; higher software demand cannot overcome insufficient torque or traction.
Hands-on exercise
Make the idea observable
Use the Day 18 simulation with output range [-1,1], a persistent unreachable setpoint for 30 steps, then a reachable setpoint.
Run with integral enabled and no anti-windup; log requested output, applied output, and integral state.
Mark every saturated step and record the largest integral value.
Change to the reachable setpoint and measure recovery time and overshoot.
Reset and repeat with conditional integration or an explicit integral bound.
Plot both integral states and applied commands on the same time axis.
Write which anti-windup rule you used and one failure it does not solve.
The protected controller usually exits saturation with less stored error, but it still cannot make an impossible physical target reachable.
The report shows requested versus applied output, saturation state, integral state, and recovery metrics for both cases.
Build today
Control a simulated pendulum or cart-pole; log setpoint, error, command, saturation, and settling time.
Evidence to save
DONE when a 60–120 second uncut “Saturation, anti-windup, and safe command limits” demo links to its command, logs or plots, result count, and honest failure note.
Common mistakes
Catch the wrong mental model
Clamping the output but hiding the original request.
Log requested output, applied output, active limit, and integral state so the cause is diagnosable.
Assuming output clamping automatically prevents windup.
The hidden integral can still grow unless the implementation explicitly limits or corrects it.
Calling a PID clamp a certified safety function.
Use independent risk-based safety mechanisms and hardware boundaries appropriate to the robot.
Job connection
How this becomes employable evidence
Validate that wheel, lift, or joint controllers expose saturation and recover predictably from blocked motion, low voltage, command limits, and released obstructions.
Relevant target roles
- Robotics Deployment, Integration & Validation Engineer
- Robotics Software Engineer — ROS 2 / AMR
Chapter 03 interview drill
Interview questions: Saturation, anti-windup, and safe command limits
Practise a 60–90 second answer: define the idea, connect it to a physical robot, state assumptions, frames, and units when relevant, then finish with the failure signal or evidence you would inspect.
Primary interview scenario
A lift stays at full output while blocked, then overshoots badly when released. Explain the logs and anti-windup tests you expect.
Answer shape: clarify the situation → trace the physical and software path → test the most likely boundaries → name the evidence that would confirm the result.
Technical follow-up questions
Q1What does clamp(11,-5,5) return?
clamp(11,-5,5) returns 5 because the requested value exceeds the permitted upper bound.
Q2Why can windup cause overshoot after an obstruction is removed?
The accumulated integral keeps commanding in the old direction after the actuator can move again.
Q3What four values make saturation diagnosable?
Requested command, applied command, active limit or saturation flag, and integral state; measurement and error add further context.