Bang-bang control and chattering in emergency management

Bang-bang control and chattering in emergency management

At 02:14 the river gauge at the upstream station crossed the action threshold. The duty emergency manager had set the evacuation trigger at that threshold weeks earlier, in a planning exercise, because the gauge was the only sensor with a reliable telemetry feed and a known lag to the town eleven kilometres downstream. By the time the order went out at 03:40 — verification, sign-off, siren activation, the usual chain — the water was already at the levee toe. The order did not anticipate the flood. It ratified it.

Nobody in the room did anything obviously wrong. The gauge fired, the protocol ran, the siren sounded within the mandated window after confirmation. The failure was upstream of all of that, in the shape of the loop itself: one sensor, one threshold, one switch from "monitor" to "evacuate," with nothing built to occupy the space between watching and acting. The order followed the hazard because the control law had exactly two states and the hazard had already moved through both of them by the time the second state was reached.

The shape of the failure

This is bang-bang control, and it is not a slur. Drive an actuator to its extremes and nothing between — full stand-down, full evacuation — switching once at a moment chosen to be optimal, and for a narrow class of problems this is provably the best you can do. If the switching moment is known exactly, bang-bang beats any softer alternative, because it wastes no time approaching the correct action gradually. The theory that proves this, going back to Feldbaum's 1953 result on minimum-time control and generalised by Pontryagin's maximum principle three years later, is not wrong. What the flood exposed is that the theory has a precondition emergency managers rarely get to satisfy: you must know, in advance and with precision, exactly where the switching surface sits.

The switching surface in a flood is not the gauge threshold. It is the true state of the catchment — antecedent soil moisture, the rainfall still falling forty kilometres upstream, the culvert already silted from last season, the mobile population that changed since the census the evacuation model uses. The gauge is a single, delayed, one-dimensional proxy for a surface that lives in many more dimensions than that. Set the threshold to fire early enough to cover the worst plausible lag and you evacuate on false alarms often enough that compliance erodes — residents who moved for nothing twice stop moving the third time, a documented pattern in flood-warning literature. Set it to fire late enough to avoid false alarms and you get 03:40 for a threat that crossed the levee at 02:50. There is no single switching point that is right for every event, because the plant — the catchment, the town, the road network people will actually use — is not a plant with one dynamic. It has many, and they change between events.

Chattering, in slow motion

Control engineers gave a name to what happens when a bang-bang controller sits near its switching surface without quite knowing where it is: chattering. The controller flips state faster and faster, hunting, grinding the actuator, injecting noise the plant then has to absorb. Emergency management rarely chatters at the frequency of a servo valve, but the pathology is recognisable at a slower tempo. An emergency manager who has been burned by one late call starts issuing precautionary evacuation advisories on marginal signals — three in a season, each partial, each eroding trust a little further, none quite reaching full evacuation because the manager no longer fully trusts the trigger either. That is chattering with a period measured in weeks rather than milliseconds: the actuator here is public compliance, and it is the thing being ground down.

The textbook fixes for chattering are deadbands, hysteresis, high-frequency pulse-width modulation, or continuously variable actuation — trading one crude correction for many small ones. Emergency management has rough analogues for the first two: multi-stage alerting, watch-warning-order ladders, phased evacuation of the most exposed streets first. These help. They do not solve the underlying problem, because every stage in the ladder is still triggered by the same sparse, lagged observation. A four-rung ladder chatters on four rungs instead of two. What actually removes chattering in a control system is not more rungs; it is faster, denser sensing of the plant, so the controller can act early and smoothly rather than switching hard because it has just noticed it is already late.

What continuous correction would look like

Read the loop as an intake problem rather than an actuation problem and the fix stops being "add another warning tier" and becomes "shorten the interval at which the hazard state is actually observed." A modern flood-decision loop that ingests upstream rain radar at ten-minute resolution, distributed soil-moisture sensors, real-time culvert and levee telemetry, and mobile-network-derived population location, is not switching between two states on one proxy. It is running a continuously updated estimate of arrival time and exposed population, and it can issue graduated guidance — stage roads now, ready shelters now, stand up transport now, order evacuation in forty minutes — before the gauge would have fired at all. The order stops trailing the hazard because the estimate of the hazard stopped lagging it.

This is the same argument that runs through every generation of these systems. A Large Language Model takes in a corpus once, takes one enormous parameter step, and then runs open-loop until the next training run — a single switch, correction bang-bang at the scale of months. A Large World Model closes the loop while a scene is live, which is real progress, but the loop reopens the moment the episode ends; the flood-response system that only ingests sensor data during a declared incident, and reverts to static planning assumptions between incidents, has this shape exactly. A Large Universe Model is the limit case: hazard sensors, movement data, infrastructure status and forecasts treated as streams that never stop, each observation revising a belief by a small increment, each increment carrying its provenance — this reading came from gauge seven, that population estimate came from carrier data three minutes old and decays in confidence after twenty — so that corrections can be attributed, and reversed if a stream turns out to be wrong.

Two objections worth taking seriously

Pontryagin's theorem says extremal switching is optimal for minimum-time problems. Evacuation is exactly a minimum-time problem — you want everyone out as fast as possible once the call is made. Building a softer, continuous system contradicts the theorem that governs the actuator you actually have.

The concession is total on the actuator: once the decision to evacuate is made, you want everyone moving at maximum rate, not gradually. Nobody proposes a "20 percent evacuation" as a continuous alternative. But the theorem is about when to flip a switch whose location is known, and the entire difficulty in emergency management is that the switching surface — the true joint state of hazard and exposure — is not known, only estimated from a lagging proxy. Bang-bang actuation is optimal on the back of accurate, continuous observation of where the surface is. It is a customer of dense intake, not an argument against it. The theorem governs the siren. It says nothing about the gauge.

Real disaster-response systems that chase continuous updates have their own failure mode: alert fatigue from over-frequent, low-confidence pushes, and operations centres that thrash between postures as data streams disagree with each other. Continuous correction can be as destructive as bang-bang switching — arguably more so, because it never settles.

This is the sharper objection and it is largely correct as a description of badly-provisioned systems. Thrashing between postures is chattering, and chattering is what happens when a system is pulled towards continuous correction without the bandwidth, filtering or provenance to support it — noisy streams treated as equally trustworthy, no decay on stale readings, no deadband on low-confidence updates. The fix is not retreating to a single gauge and a single threshold; it is boundary-layer smoothing appropriate to emergency management — confidence-weighted fusion across sensors, explicit decay on ageing population estimates, hysteresis on posture changes so a single anomalous reading cannot flip the operations centre's stance. Every one of those fixes moves toward better continuous intake, tuned properly, not away from it.

The lineage claim is not that emergency managers should watch more sensors merely because more exist. It is narrower: an evacuation regime that permits long, unmonitored intervals between observation and correction pays for that gap superlinearly, in overshoot, in eroded compliance, in orders that ratify disasters instead of pre-empting them. Carry that argument to its limit — every relevant stream, continuously, with provenance attached so bad readings can be found and discounted — and there is nowhere further to go on this particular axis. What is left after that is provisioning: more sensors, better fusion, longer-trusted history. Not a fourth kind of watching.