What closes the loop

The fastest way to misunderstand control is to point at a thermostat, a PID block or a policy model and call it “the controller”. Control is not located in a box. It is the causal circulation linking a desired condition, an observation, a discrepancy, an action and the process that action changes.

Six roles, one causal object

Suppose the ferry should remain on a centreline. The reference is that desired lateral position. The plant is the vessel plus water and propulsion dynamics. The sensor estimates present position. The controller converts discrepancy into a rudder command. The actuator turns the rudder. A disturbance, such as wind, pushes the vessel independently of the command. Delay may occur in sensing, computation, communication or actuation.

The basic notation compresses these physical roles:

Nothing in these equations says the loop is stable. They only state who can causally affect whom. A sign error can make the rudder turn with the drift. Excess gain can turn small noise into violent action. A sensor can report the wrong variable. The actuator can saturate. A plant model can omit a slow mode. Closing a loop creates a new dynamical system whose properties cannot be read from the controller alone. This lesson runs from Maxwell’s analysis of governors through Nyquist’s stability criterion and modern feedback design.¹²⁶

Feedforward and feedback solve different ignorance

Suppose a wind sensor on the harbour wall reports a crosswind before the ferry begins to drift. A feedforward path can turn the rudder immediately using a model of wind, hull and speed. It does not wait for error. This is valuable when the disturbance is measurable early and the model is sufficiently accurate. Yet an unmeasured current, a biased wind sensor or a changed load leaves residual error. Feedback then corrects what the model and disturbance sensor missed.

The two paths therefore answer different questions. Feedforward asks, “Given what is about to happen, which action should prevent deviation?” Feedback asks, “Given what actually happened, which action should reduce the deviation?” A well-designed system often uses both. The feedforward path carries specific knowledge and speed; the feedback path supplies robustness to residual uncertainty. Their interaction must still be tested. An aggressive feedforward command can saturate the actuator before feedback has room to correct, while a feedback integrator may wrongly learn compensation for a temporary feedforward bias.

Cybernetics widens the question

Engineering control asks how to regulate a defined process. Cybernetics asks what remains common when the process is mechanical, biological, cognitive or social. Wiener framed the field around control and communication in animals and machines; Ashby treated regulation in terms of transformations, constraints and variety.⁴⁵ The transferable relation is circular causation: outcomes alter information, information alters action and action alters later outcomes.

The analogy must stop where causal roles diverge. Organisms generate viability conditions through metabolism and evolution; thermostats receive setpoints; dashboards regulate chosen proxies; language models may propose without authority. Shared loop geometry does not imply shared goals, stakes, selfhood or experience. Cybernetic comparison earns its value by naming both the preserved relation and the break.

flowchart LR
  A["The ferry that corrected<br/>itself into the pier"] --> B["What closes the loop"]
  B --> C["When help arrives late"]
  C --> D["Memory meets limits"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#087A98,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

When help arrives late

A correction is useful only relative to the state it reaches. Delay changes that relation. Once the plant has moved far enough, an action calculated to oppose error can reinforce the motion that created it.

A smallest useful model

Consider a room whose temperature difference from outdoors is y. The heater command is u. The room loses heat gradually, so a first-order model is:

Substitution gives a new closed-loop time constant, τ/(1 + kK_p). Let τ = 10 minutes, k = 1, r = 1 and K_p = 4. The response becomes five times faster, with a two-minute time constant. Yet the steady output reaches only 0.8, leaving an error of 0.2. A persistent cold disturbance d = −0.5 shifts the output to 0.7. Proportional feedback suppresses the disturbance by the factor 1/(1 + kK_p), but does not remove the bias.

This arithmetic makes high gain tempting. Under the stated assumptions, more gain gives a faster response, smaller steady error and stronger disturbance rejection. Remove the no-delay assumption and the conclusion changes. A heater that acts after a long transport lag can continue adding heat while the sensor still reports cold. The equations now contain memory through delayed action, and sufficiently high gain can produce oscillation. Maxwell’s governor analysis and Nyquist’s later frequency-domain criterion made this general point precise: stability is a property of the full return path.¹²

Stability, performance and robustness are different claims

Stability, performance and robustness answer different questions. Stability asks whether trajectories remain bounded and return towards an operating region. Performance asks how quickly and accurately, and with what control effort. Robustness asks whether those properties survive plausible variation. A stable loop can be too slow; a fast loop can cross a safety boundary; a nominally excellent loop can fail after modest delay.

Compare three ferry tunes. A settles in forty seconds without overshoot. B settles in eight seconds but crosses the navigation boundary. C settles in ten seconds in the model, then oscillates when camera latency rises by half a second. No single settling-time score ranks them. Acceptance needs a region: cross-track error, settling time, rudder-rate limit, delay margin and disturbance class. One successful run shows performance at one point; robustness requires varying mass, current, delay, rate limits, noise and model coefficients until the nearest failure boundary appears.

The waterbed beneath “better control”

For a linear loop with plant P(s) and controller C(s), the loop transfer is L(s) = P(s)C(s). The sensitivity function S(s) = 1/(1 + L(s)) tells how some disturbances and modelling errors reach the output. Large loop gain can make |S| small over frequencies where regulation matters. The complementary sensitivity T(s) = L(s)/(1 + L(s)) shapes tracking and measurement-noise transmission.

This exposes a design conflict. Low-frequency gain helps reject slow load changes and persistent bias. High-frequency gain reacts to sensor noise and unmodelled fast dynamics. Bode-type integral constraints show that for important classes of systems, pushing sensitivity down in one frequency region forces it up elsewhere. This is often called the waterbed effect.⁶¹³ Feedback redistributes sensitivity; it does not abolish it.

This is also why an optimised controller can be brittle. Doyle’s compact counterexample showed that a nominally optimal LQG design need not possess guaranteed gain and phase margins.¹² The general warning is broader than one method: an objective function rewards what it contains, under the model it assumes. Robustness requires explicit uncertainty, margins and adversarial changes. It does not arrive automatically with optimality.

Memory meets limits

A controller can look at error in three temporal ways: its present size, its accumulated history and its current trend. Those views produce proportional, integral and derivative action. Their value depends on what the plant can actually do.

Why integral action removes bias

A proportional controller stops increasing its command once the remaining error is small. In the room example, some error is required to sustain enough heater output. Integral action adds the history of error:

In an ideal loop with enough actuator authority, a constant non-zero error makes the integral term keep changing. Equilibrium is possible only when the error reaches zero. This is an instance of a deeper internal-model idea: exact rejection of a class of persistent signals requires the controller to contain dynamics capable of generating that class.⁹ For a constant disturbance, the relevant internal dynamic is an integrator.

The claim has boundaries. Zero steady error does not follow if the sensor is biased, the reference is infeasible, the actuator lacks capacity, the loop switches modes badly or the plant changes faster than the controller adapts. Integral memory can only accumulate a command. It cannot create missing physical authority.

Observation is part of control, not a neutral window

A controller never acts on the plant directly. It acts on a measured or estimated state. If the ferry measures GPS position but not lateral velocity, two situations with the same position error may require opposite rudder action: one vessel may be drifting away; another may already be returning. Observability asks whether the hidden state relevant to future behaviour can be inferred from available measurements over time.⁶

Adding sensors is not automatically better. Sensors have latency, noise, bias, failure modes and correlated errors. Derivative action is especially sensitive because rapid measurement fluctuations resemble rapid state changes. Filtering reduces noise but adds delay. Estimation can recover hidden state but introduces a model whose mismatch must be tested. The controller, observer and plant form one loop.

Most real systems contain loops inside loops

The ferry may have a fast motor-current loop, a slower rudder-angle loop, a still slower heading loop and an outer route loop. The autoscaler may contain a fast admission controller around a slower replica controller. A human supervisor may alter the reference or disable automation. Each loop sees the others partly as plant dynamics and partly as constraints.

Nesting helps when inner loops are much faster and make their behaviour predictable to the outer loop. It hurts when time scales overlap or two controllers fight over the same actuator. A route controller may request a heading change faster than the rudder loop can realise it. An autoscaler may add capacity while a cost controller removes it. The resulting oscillation is not attributable to either rule in isolation. It is an interaction mode created by their coupled timing.

A practical design therefore records control hierarchy and ownership. Which loop sets the reference for which other loop? Which actuator has final authority? At what rate does each loop update? What happens during mode transfer? Bumpless transfer matters because changing from manual to automatic control with inconsistent internal state can itself create a large command. Resets, fallbacks and human intervention are state transitions inside the causal system, not operational footnotes.

Variety, models and what cybernetic slogans omit

Ashby’s requisite variety says, in engineering terms, that disturbances demanding different responses require observations and actions capable of making those distinctions.⁵ A one-bit actuator cannot correct ten independent modes unless the plant or environment supplies structure. Variety concerns effective discrimination and authority, not raw component count.

Conant and Ashby’s theorem, under its assumptions, says a maximally successful simple regulator reflects relevant system structure.⁸ It does not make every thermostat a world simulator or regulation evidence of consciousness. Francis and Wonham give a narrower result: robust rejection of specified signal classes requires matching controller dynamics.⁹ A model is required only relative to a task, disturbance class and theorem’s assumptions.

stateDiagram-v2
  [*] --> Claim
  state "The indistinguishable crossings" as Claim
  state "Six roles, one causal object" as Test
  state "A shower with two delays" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

From sketch to operating evidence

The practical unit of assurance is not a controller diagram. It is a configured loop tested under disturbances, delay, noise, saturation, sensor faults and model error. The controller lab below makes that claim executable.

The minimum loop contract

Before choosing gains or methods, write a loop contract: regulated variable and unit; reference owner and admissible range; observation window, freshness, noise and bias; actuator limits, rate and realised-action semantics; dominant plant timescales and nonlinearities; end-to-end delay; controller state, reset rules and safe modes; and required disturbance and failure coverage.

This is causal, not aspirational. “Maintain service quality”, “use telemetry” and “scale capacity” leave the loop unspecified. Every noun must become a typed variable, every arrow a timed dependency and every limit an executable invariant.

Human and machine roles belong inside the contract

Compound systems split the loop among people and software: a model proposes, policy checks permission, an operator may approve, an actuator executes and independent readback verifies effect. “Human in the loop” does not reveal whether the person owns the goal, interprets ambiguity, grants authority, recovers failure or merely confirms a settled decision.

Control analysis locates delay and state in that division. Approval can improve judgement yet make a fast loop impossible. Target changes can invalidate integral state. Predictive models can supply feedforward while deterministic controls enforce limits. Proposal, authority, typed action, effect receipt and verified outcome must remain distinct because only one signal actually closes the loop.

Generated text is not realised action. “Add three replicas” may yield one, rejection or an unknown timeout. Controller memory must update from effect receipt or independent readback, not the proposal. Otherwise software regulates an imagined plant and accumulates state against effects that never occurred.

How to use the lab

Start with the balanced preset. Increase K_p while delay remains low. Tracking becomes faster until overshoot and oscillation appear. Restore the preset, then increase delay without changing gains. The same controller crosses a stability boundary because the plant moves during the information lag. Next load the windup trap, run it with anti-windup on, then turn anti-windup off. Compare saturation duration and recovery after the disturbance ends. Finally, load the noisy-derivative preset and raise K_d. Requested action becomes jagged because the derivative term treats noise as rapid change.

The lab encodes a first-order linear plant, fixed setpoint, bounded actuator, deterministic pseudo-random measurement noise and a conditional integrator. A stable, low-error run permits a narrow claim: the chosen parameters work for this plant family and tested perturbation. An unstable or sluggish run means the loop needs retuning, slower ambition, better observation, more actuator authority or a different architecture. It cannot establish safety under unmodelled modes, correctness of the target, ethical acceptability or any property of consciousness.

function stepLoop(state, cfg, measuredY, delayedU, disturbance, dt) {
  const error = cfg.setpoint - measuredY;
  const derivative = (error - state.previousError) / dt;
  const requested = cfg.kp * error + cfg.ki * state.integral + cfg.kd * derivative;
  const realised = Math.max(-cfg.limit, Math.min(cfg.limit, requested));

  const canIntegrate = !cfg.antiWindup ||
    requested === realised ||
    (requested > cfg.limit && error < 0) ||
    (requested < -cfg.limit && error > 0);

  if (canIntegrate) state.integral += error * dt;
  state.y += dt * ((-state.y + delayedU + disturbance) / cfg.tau);
  state.previousError = error;
  return { requested, realised, error };
}

type LoopContract = {
  reference: { variable: string; unit: string; owner: string; admissibleRange: [number, number] };
  observation: { sensor: string; samplePeriodMs: number; delayBudgetMs: number; freshnessMs: number; noiseModel: string };
  plant: { modelVersion: string; dominantTimeScalesMs: number[]; uncertainty: string[] };
  actuator: { command: string; limits: [number, number]; rateLimitPerSecond: number; realisedStateReadback: string };
  controller: { law: "P" | "PI" | "PID" | "state-feedback" | "other"; persistentState: string[]; antiWindup: boolean };
  disturbances: { name: string; injection: string; acceptance: string }[];
  failures: { sensorFreeze: boolean; delaySweepMs: number[]; saturationTest: boolean; recoveryTest: boolean };
};

Test the loop, not the happy path

Change one causal property at a time: inject a step disturbance; sweep delay; freeze or bias the sensor; saturate the actuator; alter the plant time constant; add high-frequency noise; reset controller state. Each intervention targets rejection, stale observation, calibration, windup, uncertainty, noise sensitivity or hidden recovery state.

Each result needs a manifest: plant and controller versions, parameters, sensor and actuator models, disturbance trace, requested and realised actions, resets and outcome metrics. Without it, the test belongs to an unknown system.

The strongest boundary: control can enforce the wrong world

Control theory assumes that some outcomes are preferable and that a measurable variable stands for them. It can analyse how reliably a loop keeps that variable near a reference. It cannot, by itself, justify the reference, measurement bridge or distribution of authority. A platform that maximises engagement, a workplace that minimises queue time or a body that maintains a physiological variable may all be stable while producing harms outside the regulated boundary.

This is not an objection from outside control. It follows from the same causal discipline. Unmeasured states are disturbances only if the model notices their consequences. People can adapt strategically to a metric, changing the plant. Controllers can create new incentives, which alter future observations. In social systems, the loop may contain reflective agents who infer the policy and respond to it. The plant is then partly made by the controller.

A rival explanation must also be considered when feedback appears successful. Improvement after deployment may come from feedforward knowledge, a favourable environment, operator intervention or spare actuator capacity rather than the feedback law. Disturbance interventions, ablations and controller substitution are needed to isolate the mechanism. Conversely, oscillation may arise from competing loops or changing goals, rather than only excessive gain.

Recovery supplies a final discriminating test. Interrupt the loop after an action is requested but before its outcome is known. On restart, can the system establish a consistent cut across reference, controller state, pending command, realised effect and observation? Replaying the command may duplicate an irreversible action; discarding it may leave the plant changed but controller state unchanged. A recoverable loop needs idempotency where possible, explicit unknown-outcome handling and readback through a path independent of the request. Stable operation before interruption does not prove safe resumption.

sequenceDiagram
  participant Q as Question
  participant M as Mechanism
  participant E as Evidence
  participant D as Decision
  Q->>M: The ferry that corrected itself into the pier
  M->>E: The indistinguishable crossings
  E-->>M: compare rival explanations
  E->>D: Design and govern the closed loop
  D-->>Q: revise scope or act