Saturation Limit, Configuration Testing and Other Disasters

This is what happens when you forget to specify the saturation limit. P=-1, I=-0.0000002, D=0, no saturation limit is specified. Oops...

Wonder how many hours it'll take to get back in shape - no big deal, since HVAC is not controlled by DZ at this time, tit's just working as a testbed at this location. But a runaway condition like that on real hardware would have cost you a pretty dime, and possibly damaged hardware.

A saturation limit of, say, 3 would've fixed the situation.

Which brings up a question - how do you test configuration changes without jeopardizing very expensive hardware? The answer is trivial - you clone control elements of the configuration, use elements that havbe been tried and found correct to control the hardware, and use untested elements for monitoring only. Yes, there will be differentces between real behavior and tested behavior later due to the fact that control outputs from elements out of feedback loop (actual hardware control) are ignored, but you will at least get a rough idea of how they will perform.