Stability Margins and Control Headroom

A loop that only just holds is a loop about to fail; Kronos designs gain and phase margin plus actuator headroom so faults have somewhere to be absorbed.

Margin is the room to be wrong

Every control loop is designed against a model, and the model is imperfect. Stability margins — gain margin and phase margin — measure how much the real plant can differ from the model before the loop goes unstable. Actuator headroom measures how much authority is left before the loop saturates. Both must be positive with margin, because faults consume both and a saturated or marginally-stable loop cannot arrest a disturbance.

import math
def phase_margin_deg(gain_crossover_hz, delay_s):
    # transport/computation delay eats phase margin at crossover
    return 180.0 - 360.0 * gain_crossover_hz * delay_s

def headroom(u_command, u_max):
    return (u_max - abs(u_command)) / u_max   # fraction of authority left

# a 1 kHz crossover with 50 us total delay keeps healthy phase margin
print(round(phase_margin_deg(1000, 50e-6), 1))   # ~162 deg (illustrative)

How margins are spent

• Loop delay eats phase margin: every microsecond of latency in the reflex path consumes phase at crossover.
• Model error eats gain margin: an off-nominal plant shifts the effective gain.
• Disturbances eat headroom: a vertical kick or a fueling transient demands authority the loop must have in reserve.

This is why latency is a safety property, not just a performance one: the phase-margin equation ties the latency budget directly to stability. A loop redesigned to be faster is not gold-plating; it is buying back the margin that model uncertainty and disturbances will spend.

Because the phase-margin relation ties latency directly to stability, shaving loop latency is not premature optimization — it is buying back margin that model error and disturbances will inevitably spend. Kronos budgets gain margin, phase margin, and actuator reserve explicitly at design time and re-measures them in commissioning, treating a loop that merely holds under nominal conditions as a defect, since the whole purpose of margin is to survive the off-nominal conditions the loop was built to reject.

Headroom is what the vertical displacement arrest and burner confinement loops draw on when a fault hits; when a loop's headroom is exhausted, the design hands off to the reflex trip rather than pretending authority exists. Margins are budgeted at design time and re-verified in commissioning.