Actuator Saturation Management

Every actuator has limits; managing saturation keeps a loop stable and honest when it runs out of authority.

What saturation is

An actuator saturates when it is commanded beyond its limit and simply delivers its maximum instead of the requested amount. Once saturated, the loop can no longer correct errors in that direction, so it loses control authority. Managing saturation is about behaving sensibly when this happens rather than pretending it has not.

The windup problem

Controllers with integral action accumulate error over time. If the actuator is saturated, the integral keeps growing while the output cannot respond, a condition called integrator windup. When the actuator finally comes off its limit, the wound-up integral drives a large overshoot. Anti-windup schemes stop the integral from accumulating while saturated.

# Simple clamped anti-windup
u_raw = kp*e + ki*integ
u = clamp(u_raw, u_min, u_max)
if u == u_raw:            # not saturated
    integ += e*dt         # integrate only when there is headroom

Graceful priority under saturation

When actuators saturate, not every goal can be met. The control system sheds the lowest-priority objectives first, keeping authority for stability and protection. This connects saturation management to actuator allocation: both are about spending limited authority on what matters most.

Design implication

Persistent saturation is a sign the scenario is asking for more than the machine can give. Good scenario design keeps operation away from actuator limits so feedback has headroom to reject disturbances. Saturation should be a rare margin, not a normal operating state.

In the Kronos program

For the Hyperion breeder, keeping vertical-control coils out of saturation is safety-critical, since a saturated vertical loop cannot catch a growing displacement. Scenarios are designed to preserve vertical headroom, and anti-windup protects every integrating loop. These behaviors are verified in the flight simulator.