Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 PI in one page"]
N2["17.2 Sensors in the loop"]
N3["17.3 Alert storms"]
N4["Practice note"]
N5["17.1b Set-points and human placement"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 PI in one page"]
N2["17.2 Sensors in the loop"]
N3["17.3 Alert storms"]
N4["Practice note"]
N5["17.1b Set-points and human placement"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 PI in one page]
|
v
[17.2 Sensors in the loop]
|
v
[17.3 Alert storms]
|
v
[Practice note]
|
v
[17.1b Set-points and human placement]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) tune a simple PI loop and see integral action remove offset; (2) place security sensors in the control loop without destabilising it; (3) avoid alert storms that hide process alarms.
17.1 PI in one page
A proportional controller leaves steady-state offset; integral action accumulates error and removes it. The lab steps the level setpoint from 50 to 60 and shows kp-only versus kp+ki. Security engineers need this fluency so they do not propose detectors that fight the controller.
# Lab 17 - discrete PI level control vs. setpoint step (synthetic)
def sim(kp, ki, steps=200, sp=60.0):
level, integ, err_hist = 50.0, 0.0, []
for t in range(steps):
err = sp - level
integ += err * 0.1
u = max(0.0, min(3.0, kp*err + ki*integ)) # inflow m3/h capped
level += (u - 0.02*level)*0.1
err_hist.append(abs(err))
return level, sum(err_hist)/len(err_hist), max(err_hist[50:])
for kp,ki in ((0.05,0.0),(0.05,0.01),(0.2,0.01)):
final, mae, peak = sim(kp,ki)
print(f"kp={kp} ki={ki} final={final:.2f} mae={mae:.2f} peak_abs_err_after_5s={peak:.2f}")
Expected output:
kp=0.05 ki=0.0 final=44.61 mae=13.29 peak_abs_err_after_5s=15.38
kp=0.05 ki=0.01 final=57.22 mae=8.34 peak_abs_err_after_5s=10.91
kp=0.2 ki=0.01 final=58.15 mae=4.62 peak_abs_err_after_5s=6.17
Lena uses the lab to explain to colleagues why a detector should watch the error, not the raw level. The lab output shows the offset shrinking sharply once integral action is added (final level about 57–58 against 44.61 without it, still closing on 60 at the end of the run), which helps colleagues see how a controller responds to a disturbance. A detector that alarms on the level itself would fire whenever a setpoint changes.
17.2 Sensors in the loop
Inline inspection adds latency. If the process time constant is minutes (tank level), tens of milliseconds are fine. If it is tens of milliseconds (fast pressure), prefer passive taps. Measure before deploying (Chapter 3).
On the bench, Lena compares each candidate device's added latency with the time constant of the loop it would sit in: on T-1's trunk the margin is minutes, on the compressor skid only tens of milliseconds, so one device can be acceptable on the first and unacceptable on the second. Measured latency on the bench decided both choices, not the vendor's stated figures. Lena records the measured values with the time constants of each loop, so the decision can be revisited if a process changes.
17.3 Alert storms
If every medium cyber alert pages the whole site, people silence the pager — and then miss the process alarm that matters. Severity routing and rate limits on notifications are damping, exactly as in the alarm-rationalisation lab.
Synthetic case — Ashford Batch Plant. After PI lab review, Lena rejected an inline DPI box on the compressor skid (fast loop) and approved a listen-only serial tap on the slow tank trunk.
Lena's routing at ABP pages the shift lead only for high-severity events.
17.4 Errors and limits
Textbook PI ignores valve stiction and sensor delay. Use plant historians for real tuning; the lab is for intuition.
Lena tells reviewers that the lab's tidy curves are not what the plant historian shows. Real loops at ABP have valve stiction and transmitter delay, which make the response slower and noisier. Any detector threshold proposed from lab results is checked against a week of historian data before it is used, and tuning of real controllers stays with control engineers. Lena logs any differences found.
Practice note
Draw the loop: setpoint, error, controller, actuator, process, sensor, and mark where your security device sits. If you cannot mark it, you do not know whether you are measuring or actuating.
17.1b Set-points and human placement
Write the set-point next to the sensor (cycle time ≤ 50 ms). Review set-points when the plant changes recipes or when false pages exceed an agreed rate. On CNHP, people decide what a work permit authorises, and the monitor acts alone where waiting would let an unsafe write reach the process. Approving a conduit widen is human. Denying an out-of-range write is automation.
At ABP, the cycle-time set-point for the serial monitor is 50 ms, and it is reviewed when recipes change. A missed cycle-time set-point is logged with the frame that caused it, so the next review starts from data.
Exercises
- EX049 — Lab. Which (kp, ki) pair reaches nearest 60 with lowest mae? Rubric: 3 = (0.2, 0.01) with figures; 2 = pair only; 1 = wrong pair; 0 = none.
- EX050 — Placement. Inline vs tap for a 20 ms pressure loop — choose and justify. Rubric: 3 = tap/passive, latency risk; 2 = choice without why; 1 = inline casually; 0 = none.
- EX051 — Damping. One damping rule for cyber alerts in the control room. Rubric: 3 = specific (batch, severity, rate); 2 = vague; 1 = none useful; 0 = none.
Synthesis
Understand the loop before inserting security; damp alerts so process alarms stay audible.
Continue studying — chapter 17 of 50
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →