Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX033.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Programmes as loops"]
N2["17.2 Indicators"]
N3["17.3 Stability"]
N4["17.4 Rollout gates as controllers"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX033"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Programmes as loops"]
N2["17.2 Indicators"]
N3["17.3 Stability"]
N4["17.4 Rollout gates as controllers"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX033"]
[Learning outcomes]
|
v
[17.1 Programmes as loops]
|
v
[17.2 Indicators]
|
v
[17.3 Stability]
|
v
[17.4 Rollout gates as controllers]
|
v
[Engineering note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX033]
Learning outcomes
You will (1) model a migration programme as a feedback loop; (2) choose leading and lagging indicators; (3) recognize instability from over-correction; and (4) apply control ideas to rollout gates. It prepares operations (Chapter 37) and optimization (Chapter 41).
17.1 Programmes as loops
A feedback loop measures output, compares it with a set point and adjusts input. In migration, the "output" is protected share of traffic and assets; the set point is the target trajectory; the input is engineering effort and rollout pace. Without measurement there is no control — only hope.
BPA's set point is a trajectory, for example 50% of external key exchanges hybrid by the end of the first year and 90% by the end of the second. The monthly comparison of measured against planned share drives the next month's allocation of effort.
17.2 Indicators
Lagging indicators show results: percentage of key exchanges negotiated with hybrid groups, share of certificates with post-quantum signatures, unknown-asset share. Leading indicators predict results: vendors with committed PQC roadmaps, CBOM coverage, test-environment readiness. A dashboard needs both.
Lagging indicators confirm progress but arrive too late to change course; leading indicators warn early. If CBOM coverage stalls at 71%, the protected-share figure will look fine while unknown assets remain unmeasured. Pairing each lagging indicator with the leading one that drives it lets managers act before the result shows up. Every indicator has a definition and a data source written down, so two teams cannot report it differently.
17.3 Stability
Over-correction causes oscillation: enabling hybrid groups everywhere after a good week, rolling back everywhere after a bad day. Control theory suggests damping — smaller steps, delays for measurement and hysteresis (different thresholds for promoting and rolling back).
In practice, BPA promotes a rollout step only after a week of clean data and rolls back only if the failure bound exceeds twice the budget. The gap between those thresholds is the hysteresis: a single bad day inside the band triggers investigation, not a reversal. Faults are also scoped, so a problem on one path is handled on that path alone.
17.4 Rollout gates as controllers
A canary gate is a simple controller: increase exposure when the failure rate's upper confidence bound is below budget, hold otherwise, roll back only when a higher threshold is crossed. Chapter 37 implements one.
The thresholds come from the failure budget. With a budget of 10^-5 and the rule of three, a step needs about 300,000 clean connections before promotion. A rollback threshold set higher than the promotion threshold prevents the gate from switching back and forth when the measured rate hovers near the budget. Logging each decision with its data lets reviewers check the controller behaved as designed.
17.5 Worked example
BPA's dashboard shows hybrid negotiation at 62% of portal traffic (lagging) and CBOM coverage at 71% of assets (leading). Unknown assets are 18%. The control action: raise inventory effort on unknown assets rather than push portal traffic higher, because the larger risk sits where nothing is measured.
The 18% unknown assets could hold systems with 25-year data that no rollout touches, so finding them reduces more risk than pushing portal traffic from 62% to 80%. The next month's plan assigns two engineers to inventory and sets a target of halving the unknown share.
17.6 Common errors and limits
- Dashboards with only lagging indicators.
- Rolling back globally for local faults (over-correction).
- Measuring configured rather than negotiated algorithms.
A dashboard with only negotiation percentages cannot warn that inventory has stalled. Global rollbacks discard progress made on every healthy path. Measuring configured algorithms counts servers where hybrid is enabled but never negotiated, for example because clients do not offer it; BPA reads the negotiated group from session logs, which is the only figure that reflects real protection of traffic, and compares it each month with the configured share.
Engineering note
Measurement delay matters in this loop. Passive telemetry may lag configuration changes by a day; partner-side changes may lag by weeks. A controller that reacts faster than its sensors oscillates, so the rollout cadence must be slower than the slowest relevant measurement. In practice BPA sets weekly promotion decisions for internal services and monthly reviews for partner interfaces, and it records the measurement lag next to each indicator so that no one mistakes yesterday's picture for today's state.
Exercises
- EX033 — Indicators. Propose three leading and three lagging indicators for BPA. Rubric: 3 = measurable, owner named.
- EX034 — Hysteresis. Design promote/hold/rollback thresholds for a hybrid-group rollout. Rubric: 3 = distinct thresholds with rationale.
Synthesis
A migration is a controlled process: measure negotiated outcomes, combine leading and lagging indicators, damp corrections and use gates with hysteresis.
Continue studying — chapter 17 of 50
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →