Integrator windup
A Socratic walk-through of integrator windup — reasoned out one step at a time, not lectured.
The question we started with
THE QUESTION #Why does a controller that held a tank at temperature for hours overshoot wildly the first time its heater is asked for more than it can give?
A jacketed tank has sat on setpoint all week, correcting small disturbances without fuss. Then a large cold charge goes in. The heater goes to full output, which is right, and the tank warms slowly back. But on reaching setpoint the heater does not ease off. It stays flat out for another hour, driving the tank far past target, before the controller admits anything is wrong.
Nothing was retuned. The same gains that behaved impeccably for a week produced a runaway the first time the process asked for more heat than existed. So the fault cannot be the tuning as such — something about the situation changed what the tuning means.
Reasoning it through
REASONING #Ask what the controller was doing while the heater was flat out. The companion explanation here on feedback control shows why an integral term exists at all: proportional action alone leaves a standing offset, since holding any output requires some error, so the loop accumulates error over time and keeps pushing until the error is zero. That accumulation is memory, and it is the only memory in the controller.
Now put that mechanism in the saturated situation. The error is large and persistent, and the integral term grows in proportion to error times time, exactly as designed. But the output is already at 100 per cent, so every additional point changes nothing whatever in the world. The internal number climbs past 100, past 130, past 160, and none of it arrives anywhere.
This is the crucial reframing: during saturation the loop is open. The controller is still computing, but its output no longer influences the process, so the error it integrates is not evidence about anything the controller did. The integrator is faithfully recording a debt that was never owed.
Put arithmetic on it, because the asymmetry is the whole story. Take a proportional gain of 2 per cent of output per kelvin and an integral time of 300 seconds. The integral climbs at the gain divided by the integral time, times the error — so with a 5 K shortfall, 2 over 300 times 5, or 0.033 per cent per second. Half an hour is 1800 seconds, so it accumulates 60 percentage points: the computed output is now roughly 160 per cent, of which 60 points are pure excess with nowhere to go.
Now the return trip. The tank passes setpoint and settles into an error of minus 2 K. The integral falls at 2 over 300 times 2, or 0.013 per cent per second. Shedding 60 points takes 4500 seconds — 75 minutes — and throughout, the computed output stays above 100, so the heater remains pinned at full. The overshoot is not a tuning wobble; it is the loop paying off slowly a total it built up quickly.
That is where the asymmetry lives. Winding up happens under whatever large error the disturbance created; unwinding happens under the small error the overshoot creates, and that overshoot is limited by the process, not by arithmetic. Large error out, small error back: recovery must take longer than the excursion did. Two predictions follow. Recovery time scales with the integral time, so sluggish tuning makes windup worse — and it scales with how long saturation lasted, not with how badly the actuator was undersized.
The analogy
THE ANALOGY #Think of shouting instructions to someone whose phone has lost signal. You keep talking, and because they still are not doing what you asked, you keep escalating — louder, more urgent, more detail piled on. The signal returns and they hear the accumulated, escalated version rather than what you would say starting fresh. They overdo it enormously, and you spend the next while walking it back.
You would notice the call had dropped and stop escalating, whereas the controller cannot distinguish a process ignoring it from one responding slowly — both look like persistent error — which is exactly why the fix must be told about saturation explicitly.
Clarifying the model
THE MODEL #The load-bearing claim is that while the actuator is at a limit, the integral term keeps accumulating although it can no longer influence the process, and the excess must be integrated back off before the output can leave that limit. The test is a bench experiment. Drive the loop into saturation with a step disturbance, hold it there for a measured interval, remove the disturbance, and record how long the output stays pinned after the error changes sign. The account predicts that pinned time grows in proportion to how long saturation lasted, and to the integral time — so doubling the integral time doubles the delay for an identical disturbance. The refuting observation would be a recovery time indifferent to the length of the saturation, or unchanged when the integral time is changed. Both are what you would see if the overshoot were an ordinary tuning problem.
Which distinguishes this from its nearest neighbour. The companion explanation on measurement dead time analyses oscillation by gain and phase around the loop, and its own caveat is that a saturating actuator can sustain a cycle no phase argument predicts. This is that case. Windup does not change the loop's linear stability at all: it is a nonlinear transient that a Bode analysis of the same controller pronounces perfectly stable. That is why it hides for weeks and appears only when a disturbance is finally big enough.
The remedy is to tell the integrator about the limit: conditional integration stops accumulating once the output saturates, and back-calculation feeds the gap between commanded and delivered output back to bleed the excess away. Modern control blocks do one of these by default, which is why the defect now appears mainly in hand-written code, in loops whose actuator has an undeclared limit — a valve already fully open, a bypass left in manual — and in cascades where the inner loop saturates and the outer one is never told.
And what actually binds? Not the controller. Windup is a symptom of an actuator that cannot meet the demand, and no algorithm creates heat that does not exist. The accepted failure is explicit: with anti-windup fitted the loop approaches setpoint at whatever rate full power allows and no faster, and everyone accepts a slow recovery in exchange for a clean one. Buying a faster recovery means buying a bigger heater — capital spent to shorten a rare transient, a commercial judgement rather than a control one.
A picture of it
THE PICTURE #How to readStart at Regulating and follow the transition taken when a disturbance asks for more than the heater can deliver. The upper path is the failure: once saturated, the integral keeps growing although nothing it does reaches the process, so the loop sails through setpoint still at full output and can recover only by integrating the excess back off under the small error the overshoot supplies. The branch down to Clamped is the fix, and the point is that it rejoins Regulating directly, with no Overshoot in between. Saturated appears on both paths because saturation is not itself the fault — what happens to the integrator during it is.
What became clearer
WHAT CLEARED #An integrator is the controller's memory, and memory is trustworthy only when the record means something. During saturation the loop is open, so persistent error stops being evidence about the controller's own actions and the integral accumulates a total corresponding to nothing. Because the error available on the way back is smaller than the one that built the total, unwinding must take longer than winding did — which is why a loop that behaved perfectly for a week can overshoot for an hour. The fix is not better tuning but telling the integrator when its output has stopped mattering.
Where to go next
ONWARD #- Why a cascade loop needs the inner controller to tell the outer one it has saturated.
Key terms
TERMS #| Term | What it means |
|---|---|
| Saturation | the condition in which an actuator is at a physical limit and further command produces no change. |
| Anti-windup | any scheme that stops or reverses integral accumulation while the actuator is saturated. |
Every term the collection defines is gathered in the glossary.