Control · saturation

Integral Windup & Anti-Windup

The loop is tuned correctly. The valve is fully open. The controller keeps asking for more anyway.
overshoot

The loop

How big a jump you ask for. Windup is a large-step problem: small steps never saturate the actuator and never wind up.
The most the valve, heater or drive can actually deliver. Raise it far enough and the problem disappears entirely.
Shorter integral time means the error accumulates faster — and winds up faster.

The guard

Back-calculation only. How fast the integral is bled back down while the actuator is saturated. Shorter unwinds harder.

Step response

Overshoot
This run
Side by side

Same tuning, same plant, three different endings

Nothing below changes the controller gains. The only difference is what the integrator does while the actuator is pinned at its limit — and that alone decides whether the loop overshoots.

Field notes

How to recognise it in the field

How it works

The integrator does not know the valve is shut

A PI controller adds up error over time so that any lasting offset eventually gets corrected. That is the whole value of the integral term. It also means that if the error persists for a reason the controller cannot fix — because the actuator is already flat out — the integral keeps growing anyway, storing up a correction that has to be paid back later.

What actually happens

Ask for a big step. The controller demands more output than the actuator can produce, so the actuator saturates and the plant responds as fast as it physically can. The error stays positive for a long time. Meanwhile the integral term climbs to whatever value it takes to justify an output the actuator was never going to deliver.

When the process finally reaches the setpoint, the error crosses zero — but the integral is still enormous. The controller keeps the actuator wide open until the negative error has accumulated long enough to cancel it. By then the process has sailed well past the target.

The two fixes

Clamping (conditional integration): stop integrating whenever the output is saturated and the error would push it further into the limit. Crude, effective, and impossible to get wrong.

Back-calculation: keep integrating, but subtract the amount that was clipped, divided by a tracking time Tt. The integral settles at exactly the value that makes the demanded output equal the achievable one, so it is already correct the moment the actuator comes off its limit. Smoother than clamping, and tunable — a short Tt unwinds harder and settles faster at the cost of a little overshoot.

Worked example

A first-order plant with a 10-second time constant and unity gain, a PI controller at Kc = 2 and Ti = 8 s, a step to 10, and an actuator that stops at 12. Unguarded, the controller demands a peak of 20 from a valve that maxes at 12, and the process overshoots to 11.3 — 12.8% over. With clamping, the overshoot is zero and it settles in half the time. Raise the actuator limit to 200 and all three behave identically: this is not a tuning problem, and anti-windup is not a tuning trick.

How do I tell windup from bad tuning?

Change the size of the step. Windup is a large-signal effect: a loop that overshoots badly on a big setpoint change and behaves perfectly on a small one is winding up, not mistuned. A mistuned loop overshoots proportionally at every step size. The other tell is the output trace — if the controller output sits pinned at its limit well after the process value has passed the setpoint, you are watching an integrator unwind.

Why not just reduce the integral action?

Because it treats the symptom and costs you the thing the integral was for. Lengthening Ti does reduce the overshoot, but it also slows down every normal correction and leaves offsets hanging around longer. Anti-windup gives you the fast integral action for ordinary disturbances and protects you only during saturation, which is the point — with enough actuator headroom, a loop with anti-windup behaves exactly like one without.

Is clamping or back-calculation better?

Clamping is safer to deploy: one condition, no extra parameter, and it cannot make things worse. Back-calculation is smoother, and because Tt is tunable it can settle noticeably faster — on the default case here it reaches the setpoint in about half the time clamping takes, at the cost of about one percent overshoot. Set Tt near Ti as a starting point. Most commercial controllers implement one of the two and never tell you which.

Where does this bite in real installations?

Anywhere an actuator hits a stop and stays there: a heating valve on the coldest morning of the year, a level loop during a shutdown, a cascade whose inner loop is saturated so the outer one has no authority at all, and any loop left in automatic while the plant is isolated for maintenance — that last one winds up for hours and slams the actuator open the instant the plant is returned to service. Manual-to-auto transfer is the other classic, which is why bumpless transfer exists.

What this page assumes

A single first-order plant with a known gain and time constant, an ideal PI controller in parallel form with no derivative term, an actuator that is a hard symmetric clip with no dynamics of its own, a perfect measurement with no noise or filtering, and a step setpoint change from rest. Not modelled: dead time, which changes the tuning question entirely; actuator rate limits and slew, which cause a related but distinct problem; derivative action and its own kick on a step; measurement noise and filter lag; discrete sampling effects; higher-order or non-linear plant; or manual-to-auto transfer.

An idealised loop. Real plant has dead time, rate limits and noise, and real controllers implement anti-windup in ways their manuals often do not document. Use this to recognise the behaviour, not to predict a specific installation.
Version history · unchanged

No changes to this tool’s own behaviour since the earliest archived release (v1.22). The full history for the site is in the changelog.