Relay autotune and ultimate gain: how Åström–Hägglund finds Ku and Pu

The Åström–Hägglund relay autotuner is the most widely used closed-loop identification experiment in industrial PID practice. Instead of hunting for the ultimate gain by raising a proportional-only controller until the plant sits on the edge of instability — the original Ziegler–Nichols closed-loop test — you replace the PID with a relay, wait for a stable limit cycle, and read two numbers from the oscillation: the ultimate gain Ku and the ultimate period Pu. Those two numbers are the entire input to the closed-loop Ziegler–Nichols and Tyreus–Luyben formulas. The method is short, it does not require the process to sit in open loop, and it works on plants that would take an hour to settle after a step. It is also easy to abuse. A relay on a compressor discharge, a fired-heater fuel valve, or any loop whose high-PV trip is one cycle away is an incident, not a tuning session.

This article explains why a relay produces a limit cycle at all, how to extract Ku and Pu from the waveform, how hysteresis changes the answer, how to convert the pair into PID settings, and when you should walk away from the test and identify a first-order-plus-dead-time model from a step instead. The worked example is a jacketed vessel with known FOPDT parameters, so you can check the arithmetic by hand and then reproduce it in the auto tuner and the identifier.

What the relay experiment is trying to find

Every classical closed-loop tuning rule starts from the ultimate point of the loop: the frequency at which the plant, acting alone, contributes 180° of phase lag, and the gain at that frequency. If you close the loop with a proportional controller whose gain is exactly the reciprocal of that plant gain, the open-loop transfer function sits at −1 and the linearised loop is marginally stable. That proportional gain is Ku. The period of the resulting oscillation is Pu = 2π / ωu. Ziegler and Nichols, writing in 1942, told the operator to find those numbers by raising Kp on a live unit until the PV held a constant-amplitude cycle. That procedure is pedagogically clean and operationally unkind. You spend several minutes on the verge of instability, the amplitude is whatever the plant decides, and if you overshoot Ku the oscillation grows.

Åström and Hägglund replaced the P-only hunt with a relay: a two-state element that drives the actuator to u_bias + d when the error is positive and to u_bias − d when the error is negative. The relay forces a square wave of known amplitude into the plant. A plant with at least 180° of lag at some finite frequency will answer with a roughly sinusoidal PV, and the loop will lock onto a stable limit cycle whose period is close to Pu. Because the relay amplitude d is chosen by the engineer, the PV excursion is bounded. That is the safety argument, and it is only as good as the choice of d and the trip settings around the loop.

The experiment does not identify a full transfer function. It identifies one frequency-response point: G(jωu). For an FOPDT plant that point is enough to compute Ku and Pu, and those two numbers are enough for Ziegler–Nichols and Tyreus–Luyben. If you need Cohen–Coon, IMC, SIMC or AMIGO you still need K, τ and L from a step or from a more elaborate identification. The relay is not a substitute for a model. It is a substitute for the dangerous P-only ultimate-sensitivity test. See PID tuning methods for how the open-loop rules use the full FOPDT triple, and SIMC and AMIGO for why many plants should not stop at Ziegler–Nichols even after a clean relay.

How a relay produces a limit cycle

A linear plant in a negative-feedback loop with a linear controller either converges, diverges, or sits at the imaginary-axis poles of the closed-loop characteristic equation. It does not produce a stable oscillation of finite amplitude unless the loop is exactly marginally stable. A relay is nonlinear. The describing-function picture is the engineering explanation of why a bounded oscillation appears and stays.

Describing function of an ideal relay

An ideal relay with output levels ±d and no hysteresis maps a sinusoidal input of amplitude a onto a square wave of amplitude d. The first Fourier harmonic of that square wave has amplitude 4d / π. The describing function — the equivalent complex gain of the relay at that amplitude — is therefore real and positive:

N(a) = 4 d / (π a)

N(a) is large when the oscillation is small, and it falls as 1/a when the oscillation grows. That amplitude dependence is what stabilises the cycle. The loop oscillates at the frequency and amplitude that satisfy the harmonic-balance equation

G(jω) N(a) = −1

which is the same statement as “the open-loop gain through the relay’s first harmonic is −1.” Because N(a) is real, the intersection must occur where G(jω) is real and negative, i.e. at the ultimate frequency ωu where arg G(jωu) = −π. The gain condition then reads

|G(jωu)| · 4 d / (π a) = 1

so the ultimate gain, which is defined as Ku = 1 / |G(jωu)|, is exactly

Ku = 4 d / (π a)

That is the formula every autotuner implements. Measure the relay half-amplitude d (you set it), measure the PV oscillation half-amplitude a (you read it from the trend), and Ku follows. The period of the PV oscillation is Pu. No Bode plot is required on the plant. The describing function has done the frequency-response measurement for you, at one frequency.

The approximation is that the plant filters out the higher harmonics of the square wave, so the signal returning to the relay is close to a sinusoid. That is a good assumption when the plant is low-pass: tanks, jackets, rooms, most temperature and composition loops. It is a poorer assumption on a fast flow loop with little lag, where the PV still looks square. On those loops the measured a is not the first-harmonic amplitude, Ku is biased, and you are better off with a step test.

The oscillation that appears

Start the test from a steady operating point. Put the PID in a mode that freezes its output at the current bias u0, or explicitly set the relay bias to that value so the mean actuator position does not jump. Then switch in the relay. The first half-cycle drives the valve (or heater, or VSD) to u0 + d. The PV begins to move. When the PV crosses the setpoint — or, with hysteresis, when it crosses the opposite trip band — the relay flips. After a few flips the waveform becomes periodic. On a self-regulating FOPDT plant the PV is a rounded trapezoid or a distorted sine; the actuator is a square wave.

The period is set by the plant, not by the relay height. Doubling d doubles a and leaves Ku and Pu almost unchanged, which is a useful sanity check. If doubling d changes Pu a lot, the plant is nonlinear in that range, or the oscillation is riding into a constraint, or the measurement is so noisy that you are not reading a clean period. Do not average a dirty Pu. Repeat the test at a different d, or abandon the relay.

A process with no finite ultimate gain — a true integrator with very small delay, or a plant whose phase never reaches −180° inside the bandwidth you care about — will not lock onto a clean cycle. Integrating levels with significant delay do cycle, and the same Ku formula still applies, but the Ziegler–Nichols conversion was derived for self-regulating plants and is a poor match for a tank. Use an integrating-process rule, or identify K and L from the ramp and apply SIMC.

Measuring Ku and Pu from the cycle

Once the waveform is periodic, ignore the first two or three cycles. They still contain the transient from the switch-in. Then measure:

• a — half the peak-to-peak PV excursion, in the same units you will use for Kp. If PV peak-to-peak is 1.9 °C, a = 0.95 °C.
• Pu — time between successive peaks, or twice the time between successive zero crossings of the error. Average over several periods.
• d — the relay half-amplitude you actually sent, in actuator units. If the DCS scaled the relay through a characteriser, use the true actuator increment, not the faceplate increment.

Then

Ku = 4 d / (π a)
Pu = t_peak[n+1] − t_peak[n]

Ku has units of actuator per PV. If d is in percent and a is in °C, Ku is in %/°C, which is what an ISA Kp wants. Mixing a normalised PV span into a while leaving d in percent is a classic factor-of-span error; the resulting Kp will be wrong by that factor and the loop will either crawl or chatter.

On a digital trend, sample time matters. If Pu is 8 seconds and the historian is at 1 second, you have eight samples per cycle and a several-percent period error, which flows straight into Ti and Td. Capture the test on a fast trend or a dedicated autotune buffer. PID Solver 360’s identifier is the offline counterpart: you can fit an FOPDT to a recorded step and compute Ku and Pu from the model without sitting on a live cycle at all.

For an FOPDT model you do not need a relay to know the answer. The ultimate frequency solves

atan(τ ωu) + L ωu = π

and then

Ku = sqrt(1 + (τ ωu)²) / K
Pu = 2π / ωu

Use that as a check. If the relay Ku and the FOPDT Ku disagree by more than 20 %, one of the two experiments is lying: the step was not at steady state, the relay amplitude pushed the valve into a nonlinear region, or the plant is not FOPDT.

Hysteresis: noise immunity and the bias it introduces

An ideal relay flips at every zero crossing of the error. On a noisy PV that is a disaster: the relay chatters at the noise frequency, the actuator sees a high-frequency square wave, and the describing-function assumption (plant filters harmonics, input to the relay is a sine) is false. The practical relay has hysteresis. It flips to +d only when the error exceeds +ε, and to −d only when the error falls below −ε. The trip band 2ε should be a few times the peak noise, not a few times the expected oscillation. If ε is larger than the oscillation you hoped to produce, the relay never flips.

The describing function of a relay with hysteresis is no longer real:

N(a) = (4 d /(π a)) √(1 − (ε/a)²)  −  j (4 d ε)/(π a²)

for a > ε. The imaginary part means the equivalent relay gain has phase lag. The harmonic-balance intersection therefore does not lie on the negative real axis. You are no longer measuring the true ultimate point. The observed period is a little longer than Pu, and the simple formula Ku = 4d/(π a) overestimates the true ultimate gain. For ε/a ≈ 0.1 the error is modest. For ε/a ≈ 0.5 you are measuring a different frequency-response point and should not feed the numbers into Ziegler–Nichols as if they were Ku and Pu.

There is a corrected formula that uses both the real and imaginary parts of N(a) and the measured a, d, ε and Pu. Many commercial autotuners apply it. Many do not document whether they do. If you are implementing the test yourself, keep ε small relative to a: choose d large enough that a is several times ε, then apply the ideal-relay formula. If the PV is so noisy that this is impossible, the loop is a poor candidate for a relay and a poor candidate for derivative action. Identify from a filtered step, tune a PI, and move on. The structure choice between PI and PID should follow the measurement quality, not the autotuner’s enthusiasm for a third parameter.

A two-level relay with hysteresis is also a crude way to estimate more than one frequency-response point, which is the idea behind some extended autotuners. That is research-grade identification. For production PID tuning, one clean (Ku, Pu) pair or one clean (K, τ, L) triple is enough.

Converting Ku and Pu to PID: Ziegler–Nichols

John Ziegler and Nathaniel Nichols tabulated controller settings as fractions of Ku and Pu for P, PI and PID, aiming at quarter-amplitude decay: each successive peak one quarter of the previous. In the ideal (ISA) form

C(s) = Kp ( 1 + 1/(Ti s) + Td s )

the closed-loop PID rules are

Kp = 0.6 Ku
Ti = Pu / 2
Td = Pu / 8

The PI pair is Kp = 0.45 Ku, Ti = Pu / 1.2. P-only is Kp = 0.5 Ku. Convert to parallel form with Ki = Kp / Ti and Kd = Kp Td before typing into a parallel algorithm. The PID set locks Ti = 4 Td. That ratio is part of the method, not an accident. If you later cut Kp because the overshoot is ugly and leave Ti at Pu/2, you no longer have a Ziegler–Nichols controller; you have a timid proportional term integrating on a fast horizon, which is a good way to get a slow, oscillatory recovery. Conservative retuning must lengthen Ti as well. That is what Tyreus–Luyben does by design.

Quarter-amplitude decay is more aggressive than most modern robustness specifications. Expect 20–50 % setpoint overshoot on a lag-dominant plant, a complementary-sensitivity peak that amplifies noise, and a gain margin that will not survive a 50 % error in plant gain. The method still has a job: it produces a loop that moves, and the load-disturbance rejection is often better than a timid Lambda or SIMC controller with τc set large. Use it as a fast initialisation, then simulate. PID Solver 360 will apply the formulas in the auto tuner and let you inspect overshoot, settling and gain and phase margin before anyone touches a live valve.

Derivative must be filtered. A real DCS implements Td s / (α Td s + 1) with α typically 0.1. The Ziegler–Nichols Td = Pu/8 was derived without that filter. On a noisy PV, either increase α, drop to PI, or switch to Tyreus–Luyben. Taking derivative on PV rather than on error avoids derivative kick on setpoint steps; that is independent of how you got Td.

Tyreus–Luyben: the damped cousin

Tyreus and Luyben kept the experimental simplicity of (Ku, Pu) and threw away quarter-amplitude decay. Their PID settings are

Kp = Ku / 2.2
Ti = 2.2 Pu
Td = Pu / 6.3

The PI pair is Kp = Ku / 3.2, Ti = 2.2 Pu. Compared with Ziegler–Nichols PID you have about 75 % of the gain, more than four times the integral time, and a similar derivative time. The loop is slower to strip out a load offset and much less likely to ring. On a distillation-column temperature, a reactor jacket, or any quality loop that operators will put in manual after one overshoot, Tyreus–Luyben is the closed-loop rule that matches the plant culture. On a surge-tank level that should recover aggressively, it is sleepy.

Because Ti is now 2.2 Pu rather than Pu/2, detuning Kp further is less harmful: the integrator is already slow. The Td/Ti ratio is no longer 1/4, so series-form implementations that couple the terms need a proper conversion; do not type ISA numbers into a series algorithm and hope. The complete PID guide covers the forms.

Tyreus–Luyben is still a one-point method. It knows nothing about L/τ. A delay-dominated plant and a lag-dominated plant that happen to share Ku and Pu get the same controller, which is the same limitation Ziegler–Nichols has. If you already have an FOPDT model, SIMC or AMIGO will use that information and usually produce a better-documented loop. The relay-plus-Tyreus–Luyben combination earns its keep when you cannot take a clean step: a plant that will not sit in manual, a loop that is already in production, or a unit where the only permitted test is a brief, amplitude-limited cycle.

Worked example: Ku, Pu to Kp, Ti, Td

Take a jacketed vessel whose open-loop behaviour around the operating point is

G(s) = 2.0 · e^(−10 s) / (80 s + 1)

so K = 2.0 °C/%, τ = 80 s, L = 10 s. This is a lag-dominant heater with a transport delay from jacket to bulb that you should not pretend is zero. The ultimate frequency solves atan(80 ω) + 10 ω = π, which gives ωu ≈ 0.165 rad/s. Then

Ku ≈ 6.61 %/°C
Pu ≈ 38.2 s

A relay test with d = 5 % around a bias of 40 % would produce a PV half-amplitude

a = 4 d / (π Ku) ≈ 0.96 °C

Peak-to-peak of about 1.9 °C: visible on the trend, usually inside a temperature alarm gap, and small enough that the linear FOPDT picture still holds if the valve is not sitting near a seat. If the live relay measures a ≈ 0.96 °C and Pu ≈ 38 s, the experiment has confirmed the model. If it measures a = 1.6 °C, either K is larger than 2.0 in this region or the describing-function assumptions are off; do not ignore that.

Closed-loop Ziegler–Nichols PID:

Kp = 0.6 × 6.61 ≈ 3.97 %/°C
Ti = 38.2 / 2 ≈ 19.1 s
Td = 38.2 / 8 ≈ 4.8 s

Ziegler–Nichols PI: Kp ≈ 2.97 %/°C, Ti ≈ 31.8 s. Tyreus–Luyben PID:

Kp = 6.61 / 2.2 ≈ 3.00 %/°C
Ti = 2.2 × 38.2 ≈ 84 s
Td = 38.2 / 6.3 ≈ 6.1 s

Tyreus–Luyben PI: Kp ≈ 2.07 %/°C, Ti ≈ 84 s. The two PID sets are not “similar with a different Kp.” The integral times differ by a factor of four. On a load step into the jacket, Ziegler–Nichols will pull the temperature back in a fraction of a minute and overshoot the setpoint; Tyreus–Luyben will take a few minutes and stay on the correct side of a quality limit. Simulate both against the FOPDT, with the real valve limits and a derivative filter, in the closed-loop simulator. Judge them on a load disturbance as well as a setpoint step. Temperature loops live on load.

Open-loop Ziegler–Nichols on the same FOPDT gives Kp = 1.2 τ / (K L) = 4.80, Ti = 2 L = 20 s, Td = 0.5 L = 5 s. That is in the same neighbourhood as the closed-loop Ziegler–Nichols set, which is what you want when both identifications are honest. If the step-test PID and the relay PID disagree by a factor of two, stop converting formulas and go back to the experiments.

When the plant is too slow

A relay autotune that needs twelve cycles to look periodic, each of period Pu ≈ 15 min, is a three-hour experiment. Jacketed reactors, large rooms, paper-machine drying sections, and many composition loops live in that world. The method still converges, but the operational cost is the same order as a step test, and the plant is being kicked the whole time. Worse, a slow plant is often a plant with operators, quality constraints and other loops that will not tolerate a three-hour square wave on the utility.

There is a deeper issue than patience. The describing-function picture assumes the oscillation sits at ωu. On a very lag-dominant plant (L/τ of a few hundredths) ωu is well above the plant bandwidth, Ku is large, and Ziegler–Nichols then proposes a Kp that the unmodelled valve and sensor dynamics cannot support. The relay is measuring a frequency at which the FOPDT model is already a lie. You will get a number. It will be a bad controller. For lag-dominant slow plants, identify K, τ and L from a step — even a small one — and use SIMC or IMC with an explicit τc or λ. The step can be 2 % and still beat a relay that is probing a frequency the plant never uses in normal control.

If you must relay a slow loop, use a longer hysteresis in time (some autotuners add a minimum flip interval) so that noise does not add extra switches during the long wait, keep d small, and do not demand twelve cycles. Four clean periods after the transient are enough. Then detune: Tyreus–Luyben or, better, take the (Ku, Pu) pair only as a check on a model-based design.

Integrating processes that are slow — large surge tanks — produce long Pu as well. The PV will ramp rather than settle between flips. That is expected. Do not wait for a self-regulating S-curve that will never arrive.

When the plant is too noisy

Flow, some pressures, and any PV sitting on a noisy orifice or a poorly grounded 4–20 mA loop will chatter an ideal relay. Hysteresis is the first defence, as above. The second is filtering, and it is a trap. A first-order filter on the PV adds phase lag, lowers ωu, lengthens Pu, and reduces Ku. The autotuner then designs a controller for the filtered plant. If you leave the filter in, that can be correct. If the filter was only for the test and you remove it afterwards, you have designed for the wrong loop. Document the filter. Prefer to keep a modest filter in normal operation on a noisy PI loop anyway; see the noise discussion in how to tune a PID controller.

A noisy oscillation also makes a and Pu uncertain. Peak-picking on a jagged sine overestimates a (so underestimates Ku, which is conservative) or, if you smooth too hard, underestimates a. Period estimates from zero crossings wander with the noise. Average several cycles, discard the test if the period standard deviation is more than about 10 %, and do not add derivative on a PV that needed ε comparable to a to get a cycle at all.

If the signal-to-noise ratio is so poor that a 5 % relay is invisible in the PV, you cannot identify Ku this way. A step test with averaging at the initial and final steady states still can: the two levels are held long enough that noise averages down. That is one of the practical reasons the step remains the default identification in PID Solver 360 even though the relay is theoretically elegant.

Safety: loops you must not relay

The bounded-amplitude argument is only as good as the bound. A relay of d = 5 % on a temperature valve is usually a small jacket move. The same 5 % on a compressor anti-surge valve, a fired-heater fuel-gas valve, or a reactor feed where stoichiometry sits near a trip is not a small move. The PV may cycle inside the alarm gap while a secondary variable — discharge temperature, tube-skin temperature, oxygen, column loading — does not. Autotuners look at one PV.

Do not relay:

• Compressor discharge pressure, anti-surge, or recycle. A limit cycle here is a surge cycle with extra steps. Tune from a model or from a tiny step on a quiet day, and keep the surge controller’s own protections in charge.
• Fired-heater fuel and damper loops that sit under skin-temperature or stack-oxygen trips. Use a fuel-flow slave and tune the temperature master conservatively; see cascade PID.
• Any loop whose PV-high or PV-low trip is closer than about two expected amplitudes from the setpoint. If a is 1 °C and the trip is 1.5 °C away, you will find out whether the trip works.
• Tightly coupled units where the square wave is a disturbance into a neighbouring loop that you do not have permission to upset.
• Loops with a sticky valve. The relay will measure friction, not Ku. Fix the valve.

On a permitted loop, still write down the abort criteria before the test: maximum cycles, maximum |PV − SP|, maximum time, and the output clamp. A relay that can only move ±3 % around the current output is a different experiment from one that can slam 0–100 %. Commercial autotune blocks often expose that clamp; use it. Enable anti-windup on the PID you install afterwards, because the first real setpoint step will saturate a Ziegler–Nichols controller even if the relay never did.

The other safety point is mean shift. If the relay bias is not the true steady-state output for the current setpoint, the PV will ramp or settle to a new mean while it oscillates. Operators see a drifting cycle and abort. Set the bias from the output that was holding the PV at the setpoint in automatic, and do not change upstream loads during the test.

Relay versus step-test FOPDT identification

A step test in manual — wait for steady state, step the output by a known Δu, wait until the PV has clearly settled, read K = Δy_ss / Δu, then τ and L from the two-point method or a tangent — identifies the model that every open-loop rule wants. It is the right default when the plant will sit in manual and the time to settle is acceptable. The identifier is built around that experiment. The relay is the right default when the plant will not sit in manual, when open-loop drift would ruin a step, or when you only need (Ku, Pu) for a closed-loop rule.

They do not measure the same thing. The step sees DC gain and the low-frequency shape of the reaction curve. The relay sees the frequency-response magnitude at ωu, which is often a decade above the intended closed-loop bandwidth. For a true FOPDT the two are consistent, which is why the worked example’s open-loop and closed-loop Ziegler–Nichols sets were neighbours. For a plant with extra high-frequency lag (thermowell, valve, filter) the relay Ku is smaller than the FOPDT prediction, and that is useful: the relay has seen dynamics the three-parameter model omitted. For a plant with a slow disturbance during the step, the step K is wrong and the relay, being shorter and closed-loop, may be more honest.

Practical comparison:

• Time. Step needs one settle-out plus one settle-in, often 8(τ + L). Relay needs a few periods of Pu, often 4–8 × Pu. On lag-dominant plants Pu is much shorter than τ, so the relay can be faster. On delay-dominant plants they are similar.
• Permission. Step requires manual. Relay can run as a special automatic mode. That is why DCS vendors ship relay autotune and not a step wizard.
• Amplitude. Both must stay linear. A 10 % step and a 5 % relay are comparable valve moves; neither is “safe” merely because it is an autotune.
• What you can tune afterwards. Step → any FOPDT rule, including SIMC and AMIGO, plus a full simulation. Relay → Ziegler–Nichols, Tyreus–Luyben, and a check on a model. If you care about robustness across L/τ, prefer the step.
• Noise. Step wins by averaging at two plateaus. Relay needs hysteresis and a clean sine.
• Integrators. A step on a level produces a ramp; you fit K/s e^{−Ls} rather than FOPDT. A relay still cycles. Interpret with the right rules.

A hybrid that is under-used: take a small step, fit FOPDT, compute Ku and Pu from the model, and skip the live cycle. Confirm with one cautious closed-loop setpoint step. That is the PID Solver 360 workflow: identify, apply a rule in the tuner, inspect simulation metrics, then go to the plant with a controller you have already rejected the bad versions of. The docs list the studio modes if you are landing on the tool for the first time.

A field procedure that does not embarrass you

Write the loop sheet first: PV, SP, output, spans, trips, valve fail direction, whether the process is self-regulating, and a guess at τ. If you cannot guess τ to a factor of three, you do not know whether the test will take two minutes or two hours.

Check that the loop is allowed to move. Tell the operator what the PV will look like (a few cycles, amplitude about 2a) and what the abort is. Put a clamp on the relay output. Choose d so that a will be visible but inside the alarm gap; on a temperature loop 3–8 % is typical, on a fast flow loop 2–4 %. Set hysteresis from a snapshot of noise, not from folklore.

Switch in the relay from a steady automatic condition. Discard the first cycles. Read a and Pu. Compute Ku = 4d/(π a). Apply Tyreus–Luyben unless you have a documented reason to want Ziegler–Nichols’ load rejection and can live with the overshoot. Install the PID with derivative on PV, a filter, and anti-windup. Make one setpoint step of similar size to a and one wait for a natural load. If the plant is slow or noisy, do not be heroic: step-test, identify, and use SIMC.

Store the raw trend. An autotune that cannot be audited did not happen. If you later identify an FOPDT from a step, file both (K, τ, L) and (Ku, Pu) on the loop sheet. They should be consistent. When they are not, the plant has told you that the linear three-parameter story is incomplete, which is more valuable than another formula.

The relay autotuner is a tool for measuring one point on G(jω) without taking the loop to the brink with a P-only gain search. Used on a permitted, reasonably linear, reasonably quiet plant, it gives Ku and Pu good enough for a first PID. Used as a substitute for thinking about trips, noise, and whether Ziegler–Nichols is even the rule you want, it is how loops get a reputation for autotune being “too aggressive.” The aggressiveness was in the conversion table. The relay only told you the truth about the ultimate point. What you do with that truth is a tuning choice, and it should be made in simulation against a model you trust, with the same actuator limits the plant will enforce.