The Verification Venue · a conservation law you can fail to violate
The Error You Can Only Move
A feedback controller does not destroy error. It moves it, from one band of frequencies to another, and the total it has to move around is fixed by a law from 1945. Here is a loop you can tune until you believe you have beaten it, and the ledger that shows you never did.
The instrument below is a cruise control holding 25 m/s as the car meets a 4% hill at the tick mark. You have three knobs, the three terms of a PID controller: P reacts to the error now, I accumulates the error over time, D anticipates its change. Start with the first preset and drag the P slider. The car will settle, but watch where.
Presets (then move the sliders yourself)
Steady-state offset
–
where the speed settles
Worst dip
–
deepest error
Closed loop
–
slowest mode
With P only, the speed settles below 25 m/s and stays there. That gap is the steady-state offset: the loop needs a standing error to hold any throttle at all.
Two truths arrive in the first ten seconds. With P alone the speed never reaches 25 m/s: it settles low and stays there, because a pure proportional loop needs a leftover error to keep the throttle open on the hill. Add a little I and that offset dies, exactly, because the integrator keeps winding until the error is gone. Then get greedy: crank the gains and the ride starts to ring, and past a line it diverges, the simulated speed running off the chart. So far this is ordinary tuning lore. Now the catch.
The dismissal, and the law that answers it
The reasonable conclusion from the panel above is: offset and ringing are just bad tuning; a good enough controller beats both, everywhere. It is wrong, and the reason is not a better algorithm but a conservation law. Define the loop's sensitivity S(jω) = 1 / (1 + L(jω)): at each frequency it is the factor by which a disturbance at that frequency shows up in the output. |S| < 1 means that frequency is suppressed; |S| > 1 means it is amplified, made worse than doing nothing. Good control drives |S| down where it matters.
In 1945 Hendrik Bode proved you cannot drive it down for free. For a loop that is open-loop stable and rolls off at least as fast as 1/s² (both true here), the area of ln|S| across all frequencies is pinned:
Below the zero line and above it, the two shaded areas must cancel. Squeeze the error down in one band and it is not gone: it has been pushed up into another band. This is the waterbed effect. Watch it below. The curve is ln|S| against frequency; blue is suppressed area, red is amplified area. The same three sliders drive it. Try to make the blue swallow the red.
Suppressed area
–
where |S| < 1, over 10⁻⁶–10⁶
Amplified area
–
where |S| > 1, over 10⁻⁶–10⁶
Total (pinned)
–
band + analytic tails
Peak sensitivity Ms = max |S|
–
the tallest the waterbed hump gets
Guaranteed margins from Ms
–
gain margin ≥ Ms/(Ms−1), phase ≥ 2·asin(1/2Ms)
Drag the I gain up from the "integral" preset: the blue notch at low frequency deepens, and a red hump grows to its right. The total holds at zero. You are not removing the error, you are shovelling it uphill in frequency.
Here is the honest shape of it. The pile preset squashes a lot of low-frequency error but stacks it into one tall, narrow hump: Ms climbs toward 3.6, and a peak sensitivity that high means a disturbance near that frequency is amplified more than threefold, with thin stability margins. The spread preset suppresses more total area, yet its hump is shorter (Ms ≈ 1.05): it lays the same conserved area out thin, far up in frequency. That is what good tuning is. Not beating the integral, choosing where to pay it. And the spread pays elsewhere too: its loop amplifies sensor noise into the throttle about 85× harder than the pile does (both figures are the noise→throttle column in the check table below). Move the error off the ride and onto the actuator.
The floor you cannot get under
Switch the plant to inverted pendulum (a rod you must balance upright). Now the open loop has a pole in the right half plane: the thing falls over on its own. Bode's law still holds, but the right-hand side is no longer zero. In the extension of Bode's result to unstable plants (Freudenberg & Looze, 1985) it becomes π · a, where a is that unstable pole. The suppressed area can no longer cancel the amplified area; there is a permanent surplus of amplification, π·a ≈ 12.05 rad/s, that no choice of gains can remove. Balance the rod every which way and the total holds at that floor. An unstable plant charges rent, and the rent is the unstable pole. Watch the total sit on π·a as you tune.
The check: every number recomputed in front of you
The loop transfer function for your current gains, its pole with the largest real part (positive means unstable), and the sensitivity integral computed live over the shown band:
| preset | Ms | suppressed | amplified | ∫ ln|S| dω | noise→throttle | closed loop |
|---|
Run the same math offline: node research/the-error-you-can-only-move/verify-the-error-you-can-only-move.mjs (76/76 checks). The page and the verifier share the same functions; where they can only agree to a tolerance, it is stated below.
Every free choice and uncertainty, named
- The band is finite. The theorem integrates over all frequencies; the page and verifier integrate over ω ∈ [10⁻⁶, 10⁶] rad/s and add two analytic tail terms for the rest (low: the integrator slope; high: the 1/ω² rolloff). The truncation is a stated number, not a shrug.
- The quadrature is approximate. The area is Simpson's rule in u = ln ω with 2000 panels. For clearly stable loops it lands within ~10⁻⁶ of the theorem; right at the edge of instability a tall narrow hump makes the finite grid wobble at the third decimal. That wobble is the truncation being honest, not the law failing.
- The derivative filter is a choice. Real PID needs D filtered to be physical; we use Kd·s/(Tf·s+1) with Tf = 0.05 s fixed. It keeps the loop relative degree exactly 2, which is the theorem's precondition.
- The plants are linearised. Cruise: a small-signal model about 25 m/s with a single lumped road-load coefficient (real drag is quadratic in speed). Pendulum: a uniform rod linearised about upright. The shape of the result (offset, ringing, the pinned area, the floor) does not depend on these numbers; the exact figures do.
- The preconditions are load-bearing. The integral is 0 only when the open loop is stable and rolls off at least as 1/s². Destabilise the closed loop and the theorem simply does not apply; the panel flags it and stops claiming zero. Make the plant open-loop unstable (the pendulum) and the target moves to π·Σ Re(pₖ), shown live.
What is exactly true here, and what is idealised
Exactly true. Bode's sensitivity integral (Bode, Network Analysis and Feedback Amplifier Design, 1945) is a theorem, not a model: for a rational open loop L(s) that is stable and has relative degree ≥ 2, and a closed loop that is stable, ∫₀∞ ln|S(jω)| dω = π·Σ Re(pₖ) over the open-RHP poles pₖ (zero if there are none). The suppressed-band / amplified-band tradeoff is a rigorous consequence, and it holds for every controller that meets the hypotheses, not just PID.
Not what the waterbed forbids. The theorem constrains the log-sensitivity area, and nothing else. It does not say good control is impossible, nor that performance in any single band is capped. You can make |S| as small as you like over any finite band; you simply pay for it with area elsewhere. The "spread" preset is the proof: more suppression, lower peak, because the cost was moved to frequencies and actuators you were willing to spend.
Idealised. No measurement noise or actuator saturation in the trace (both are real limits a full design must respect, and the noise cost is quantified in the check); linear plants; a fixed derivative filter; perfect models. The point the instrument makes is a conservation law, and conservation laws survive the idealisation: relaxing any of these moves the numbers, never the ledger.
On "conserved." Calling the pinned area a conserved quantity is a physicist's turn of phrase for an invariant of the map from controller to closed loop, not a claim about energy. It is invariant under any admissible retuning; that is exactly the sense in which you can move the error but not destroy it.