The Same Control Problem, Twice

Flow is stabilised by the person sitting in it. Cama is stabilised by a loop we had to build, because the person in it cannot close the one they normally use. Almost every architectural difference between the chair and the bed follows from that.

We build two machines that share a company, a design language, and almost no engineering.

Flow is a chair with fifteen degrees of freedom, driven by two motors and a cam-based selector clutch, reconfiguring underneath a person who is awake and working. Cama is a bed with forty-two independently actuated blocks and four recliners, reading 10,752 pressure points, making roughly fifty micro-adjustments an hour against a person who is asleep. Different actuators, different transmissions, different sensing, different failure analysis, largely different teams.

Read the two programmes side by side and they look unrelated. They are one control problem, evaluated at two ends of a single variable — and the variable is not whether the user is in the loop. The user is always in the loop. It is which part of the loop they are able to occupy.

The argument, in one axis

The whole article in one picture. Cama's engineered loops sit between the two biological ones — a hundred times slower than the reflexes Flow borrows, a hundred times faster than the body's own repositioning.

§ 01

One person, three roles

A person in contact with an adaptive surface appears three times in the block diagram, and the three are routinely collapsed into one, which is where the confusion starts.

Plant. The body being acted on — mass, compliance, geometry. Present in both products, always.

Sensor. The body generating a measurable response. Present in both, and considerably richer in Cama than in Flow: 10,752 pressure points plus heart rate, respiratory rate and heart-rate variability is more instrumentation than we point at a Flow user.

Compensator. The person computing an error and applying torque to correct it. This is the block whose gain varies, and the only one of the three that ever approaches zero.

Confusing the third with the other two produces both of the mistakes we care about. Say "the user is out of the loop" and you have written the sleeper out of the diagram entirely, which is wrong — Cama watches them all night. Say "the user is in the loop" and you imply they can act, which invites a safety case that leans on a correction they cannot make.

Only the compensator moves. Aviation gives us its form. McRuer and Jex's crossover model states that near the frequency region governing stability, a human operator behaves approximately as a gain, a pure transport delay, and a first-order lag.¹

Y_p(jω) ≈ K_c · e^(−jωτ) · 1/(T_n·jω + 1) K_c is compensator gain, τ transport delay, T_n neuromuscular lag. An empirical describing function, valid only near crossover, and quasi-linear — it carries a remnant term for the part of operator output uncorrelated with the input. It is a simplification. It also has units.

The delay is structural, not attentional: transduction, nerve conduction, central processing, and electromechanical delay inside the muscle. A spinal reflex costs tens of milliseconds; anything voluntary costs on the order of 150 to 300. No amount of training removes it, because none of those stages is a skill.

A note for readers who have not had to think about phase margin. A feedback loop works by correcting error, and a correction only helps if it arrives while it is still the right correction. Phase margin is how much lateness a loop can absorb before its corrections start arriving so late that they add to the error instead of removing it. Every delay in the loop spends some of it, and delay costs more the faster the loop is trying to work. When the margin runs out, the system oscillates.

Then the arithmetic, which is the whole argument. A pure delay contributes ωτ radians of phase lag at frequency ω.

φ = ω·τ = 5 rad/s × 0.2 s = 1.0 rad ≈ 57° A loop crossing over at 5 rad/s, with 200 ms of human delay in the return path, loses roughly 57° of phase margin to the person alone.

Figure 01 / The phase budget, spent

Figure 01. The person is not a disturbance on the margin. At a 5 rad/s crossover they consume more of it than most designs allocate in total.

Characterise a chair on a bench against a fixed dead load, budget 45° of phase margin, ship it, and the loop was already unstable before anyone sat down.

Figure 02 / The person appears three times

Figure 02. The plant and sensor roles are present in both products at roughly constant gain. Only the compensator path varies, and it is the one nobody draws.

§ 02

Flow: the compensator is present, adaptive, and will fight you

Flow's occupant is awake, in continuous contact, and attending to something else. On the awareness axis defined in The Fourth Law, that is the distracted band rather than the fully aware one — K_c reduced and τ lengthened by attention allocation, but neither eliminated.

The uncomfortable part of the crossover model is not the delay. It is the adaptation. Operators adjust their own gain until the combined open-loop response looks roughly the same, largely independent of what the machine underneath is doing.¹ Change the controller and frequently you do not change stability. You change who is compensating.

Our own team is the worst available test population for Flow. An engineer who has sat in the prototype for six months has adapted to it and compensates below awareness, the way you stop noticing a car's steering deadband a week after buying it. The chair feels good because the tester has become the missing controller. Testing with experienced users measures skill acquisition, not machine quality.

The failure is a cliff, not a slope. Adaptation has range. Inside it, everything looks well-tuned. At the edge the person runs out of gain and the loop goes unstable in one step, with no gradual degradation as warning.

Figure 03 / Why a badly tuned chair feels fine until it doesn't

Figure 03. Human adaptation flattens the curve, which is why a machine can be badly tuned and still feel acceptable — right up to the point where the occupant runs out of gain. There is no gradual warning.

Aviation has both a name and a mathematics for the version of this that hardware people cause. A rate-limited actuator meeting an adapting operator produces a Category II pilot-induced oscillation, and describing-function analysis of rate limiting quantifies the added phase lag, the magnitude reduction, and the resulting limit-cycle frequency.² A rate limiter is not a free safety feature. It is a nonlinearity that manufactures phase lag as a function of input amplitude, so a small-signal gain margin is worthless at exactly the moment the occupant pushes hard.

And the instability does not diverge. Bounded above by actuator rate limits and below by human stiffness, it presents as a sustained limit cycle. It never trips a fault, never exceeds a current threshold, never registers as an error. Users report vibration or roughness; it gets triaged to mechanical, who correctly find nothing wrong with the mechanism.

Figure 04 / A rate limiter manufactures phase lag

Figure 04. Above: saturation turns a linear actuator into one whose effective delay grows with how hard the occupant pushes, which is exactly when a small-signal margin stops applying. Below: the multiplexed powertrain caps Flow well short of the band where it would couple with reflexes.

What follows for the chair

Impedance is the design variable. "Position control or force control" is the wrong question; both are extreme points on an axis whose real quantity is the impedance the occupant feels, and impedance can be specified and superposed as a control objective in its own right.³

Stiffness is a voluntary input, so trust is a plant parameter. Not a metaphor about user confidence. Burdet and colleagues showed that in an unstable environment the CNS learns to raise limb impedance selectively along the destabilising direction rather than co-contracting uniformly — the nervous system is running its own impedance controller against yours.⁴ Endpoint stiffness is directionally tuned to the instability the person perceives.⁵ So the loop closes badly: the chair feels unstable, the occupant stiffens along the axis that feels wrong, contact dynamics shift, and the machine is now working against a different plant.

Do not put actuation bandwidth where the reflexes live. Large-amplitude voluntary motor output is concentrated below about 4 Hz, and physiological tremor occupies a persistent 8–12 Hz band attributable to motor unit synchronisation and reflex loop dynamics.⁶

Flow's powertrain is well placed here for a reason that was not the original reason. Sohan's multiplexing architecture — one power motor, one cam-based selector, self-locking transmissions holding position at zero energy draw — was justified on duty-cycle and installed-capacity grounds, with the half-second selector switching time framed as a cost to be reduced toward the 100–200 ms threshold of proprioceptive resolution.^A Stated in control terms, that architecture makes Flow quasi-static by construction. It cannot put meaningful energy into the 8–12 Hz band because it cannot cycle a degree of freedom that fast. A powertrain decision taken for cost reasons keeps the chair structurally out of the range where it would couple with human reflexes.

That paper also contains the general form of the argument this one is making. Its condition for extending multiplexing to dynamically unstable machines is that the product of simultaneously active degrees of freedom and switching time per degree of freedom must stay below the system's stability time constant.^A That is bandwidth matching on the actuation side. Everything below is the same condition applied to sensing.

Passivity beats modelling. We will never have a good model of every Flow user; age, fatigue, medication, spasticity and posture move the plant within a single session. A device that cannot generate net energy is stable against all of them, modelled or not — which is why the haptics literature bounds achievable impedance by a passivity condition rather than by a nominal-plant phase margin.⁷

Water already ships a passive stabiliser, on the other product. Abdul's constant-force duvet tensioning modules hold roughly 10 N across a 600 mm stroke with no controller, no power and no signal.^B His closing line — the physics is the controller — is a passivity statement. A pre-stressed spring cannot inject net energy into the surface no matter what the block array does underneath it. Every place we can push a stabilising function into a passive element is a place where human gain stops mattering.

§ 03

Cama: the compensator is displaced, not deleted

Now move along the axis, and be careful, because the obvious statement is wrong.

The sleeping human is not a passive object. They are running a postural control loop, all night, and Teja documented it in Nobody Is Vouching For Your Body: the average adult shifts position roughly thirteen times a night, about 1.6 major shifts an hour, without knowing any of it.^C The body does this because tissue under the hips and shoulders starves of oxygen if it stays still. It is a feedback loop with a sensed error, a controller and an actuator, and it has been running for as long as we have been mammals.

We know it is a genuine control loop because medicine has documented, for decades, exactly what happens when it is disabled. In a person with intact sensation and mobility, sustained interface pressure triggers a response that prompts a position change; in a person lacking sensation and mobility, tissue hypoxia proceeds to ischaemia and skin breakdown.⁸ Pressure injury is the failure mode of an open postural loop. That is as clear a demonstration of a controller's existence as engineering ever gets.

So the question for Cama is not whether the sleeper compensates. It is at what rate, and at what cost.

The rate is very low. Roughly 1.6 major shifts per hour is about 4 × 10⁻⁴ Hz — four orders of magnitude below the voluntary loop the same person runs while awake.

The cost is an arousal. Each shift coincides with a brief spike in brain activity the sleeper almost never remembers, and on the wrong surface every one is larger than it needs to be, because the body has to push out of the depression the mattress made around it.^C The biological compensator does not correct for free. It pays in sleep fragmentation.

Cama does not replace the sleeper's postural controller. It runs in parallel with it — faster, and without the arousal cost.
THE PRODUCT, IN CONTROL TERMS

Which also gives a definition for something Teja named but did not formalise. Spine debt is the integral of the error the slow loop never got to.

Then REM, where even this path closes. Skeletal muscle atonia is active inhibition at the motoneuron, not merely reduced drive: Brooks and Peever showed that a combined GABA and glycine drive silences motoneurons, and that paralysis reverses only when metabotropic GABA_B and ionotropic GABA_A/glycine inhibition are blocked together.⁹ For roughly 20–25% of the night, in every healthy adult, by design, the compensator's output stage is disconnected. Not slow. Disconnected.

Arousability follows a related but distinct curve. Auditory arousal thresholds rise as NREM deepens and are highest in slow-wave sleep;¹⁰ and REM is not uniform — thresholds in tonic REM resemble stage 2 while thresholds in phasic REM resemble stage 4.¹¹

Figure 05 / Three return paths, not one

Figure 05. Schematic, not measured — drawn to the direction and magnitude of published findings, not our own data. Two of the three paths survive into Cama's operating region. Both are slow.^9,10,12

This sharpens a definition we made in The Fourth Law, where Class 6 was defined by the awareness of the human being acted on and split by whether control logic is hand-written or learned.^D Redraw it and the definition stops being descriptive:

And a note on our own jargon. In The Fourth Law we sorted machines into six classes by two questions: how aware is the person being acted on, and was the control logic written by an engineer or learned from data. A powered recliner with a remote is Class 03. An auto-adjusting CPAP working on a sleeping patient is Class 6A. Class 6B is the corner where a learned model acts on a person who cannot supervise it — the corner with no published safety standard, and the one Cama occupies for its entire duty cycle.

Class 6B  ≡  compensator path slow or open
            ∧  plant and sensor paths intact
            ∧  forward path learned

Awareness is not a soft property of the user. It is the gain of one block. Class 6 is the region where that block cannot act on the timescale the machine does — while remaining fully present as plant and as sensor.

Figure 06 / Both products, on the Fourth Law grid

Figure 06. Extending the ladder from The Fourth Law^D with both products placed on it. Flow and Cama share a row — both run learned control — and differ only along the horizontal. The dashed arrow is the transition of § 06: a Flow occupant dozing off moves the product one cell left, into a class its architecture was not designed for.

And it explains why the rate-ceiling argument in Physical Intelligence, Safely takes the shape it does.^E Cama's 10 mm/s hard ceiling cannot be justified by "at this speed the user has time to react," because at 4 × 10⁻⁴ Hz they do not, and in REM they cannot. The envelope has to hold with the compensator path deleted. Not attenuated. Deleted.

◆

Stop here if that is enough. What follows is the engineering the argument forces, and how much of it we can defend.

§ 04

What Cama closes instead

If the fast compensator path is open and the slow one is expensive, the machine has to close something of its own.

Somers and colleagues measured muscle sympathetic nerve activity directly by microneurography across all sleep stages. Burst amplitude, blood pressure and heart rate declined significantly as NREM deepened; during REM, sympathetic activity rose to 215 ± 11% of waking baseline.¹² The autonomic system does not sleep.

One result in that paper matters more to us than the headline. Arousal stimuli delivered during stage 2 produced K-complexes frequently accompanied by bursts of sympathetic nerve activity and transient blood pressure rises — without waking the subject.¹² That is the operating principle of Cama's Validator, demonstrated in 1993: an external mechanical stimulus applied to a sleeping human produces a measurable autonomic response within seconds, in a body whose voluntary motor path is unavailable.

So the Validator is not an extra sensor and not a monitoring feature. It is an engineered fast path substituting for a biological slow one, and the reason it must be physically independent — its own power, its own connector, its own fault domain^E — is that Cama's user has no mechanical recourse. A Flow occupant whose sensors all fail can still shove the chair. A Cama sleeper whose heart-rate channel fails has nothing but the arousal.

Figure 07 / Cama's four return paths

Figure 07. Four return paths through one sleeping person. The engineered pair sit between the biological ones in bandwidth.

The bandwidth ladder

Path	Usable bandwidth	Status in sleep
Voluntary motor	< ~4 Hz	Open
Reflex / tremor	8–12 Hz	Attenuated; inhibited in REM
HR / resp. rate	~0.1–0.3 Hz	Closed — engineered
Heart-rate variability	~0.02–0.03 Hz	Closed, batched — engineered
Repositioning	~4 × 10⁻⁴ Hz	Closed; costs an arousal

The HRV figure deserves care, because we had it wrong internally for a while. The 1996 ESC/NASPE standard defines short-term analysis on five-minute recordings, and frequency-domain measures genuinely need that window.¹³ Time-domain measures do not. In 3,387 adults, RMSSD from 30 s agreed closely with the 240–300 s reference, and agreement was near-perfect by 120 s.¹⁴ The right number for a time-domain reward is 30–60 s, not five minutes.

Reading the ladder from both ends gives the two facts that determine Cama's architecture.

Downward: the engineered loop is far slower than the loop Flow gets free. Two orders of magnitude. At 0.5 mm/s a 30 s HRV window admits 15 mm of accumulated travel before the slow loop yields a single usable sample; 60 s admits 30 mm. Against blocks with 250 mm of stroke that is a substantial excursion taken blind. So HRV cannot be the correcting loop — only a slow integral term scoring a batch — and per-action correction must ride on the fast HR/RR path, which is exactly the path Somers showed responds within seconds. The multi-rate reward structure in Physical Intelligence, Safely was presented there as a consequence of what is computable.^E It is more than that. It is forced by this arithmetic.

Figure 08 / One minute of the loop, to scale

Figure 08. The multi-rate structure is not a convenience. HRV yields one usable number per 30–60 s window, by which point the array can have moved 15–30 mm. Correction has to ride on the fast channel; the slow one can only score the batch afterwards.

Upward: the engineered loop is far faster than the loop the sleeper runs alone. Also two orders of magnitude. This is the part that makes the product coherent rather than merely safe. Cama can act between the body's own corrections, which is the only way to reduce the arousal count rather than add to it.

One more element sits inside the sensing path and is easy to forget: the mattress. Sai Harsha and Kaushik showed that a material's Deborah number governs whether the surface can reshape between actuator events — memory foam at De ≈ 3–8 cannot, so the sensor reads a blurred temporal average, while the shipped super-soft layer at De ≈ 0.8–1.2 settles within roughly one cycle.^F That is transport lag in the feedback path, chosen in materials rather than in code.

◆ THE CONSEQUENCE THAT MATTERS

When every available return path is orders of magnitude slower than the actuation it observes, feedback cannot be the primary safety mechanism. Anything that must not happen has to be prevented before it happens, not corrected after.

Cama's frozen Critic gating every command feedforward is not a design preference or an abundance of caution. It is what the bandwidth ladder leaves available. Kaushik put the same principle a different way in the control-space paper: ML detects, deterministic mechanisms act.^G Flow, with a live compensator closing below 4 Hz, can afford an architecture Cama cannot.

§ 05

Why the two architectures diverge

	FLOW	CAMA
Compensator gain	High, adaptive, self-retuning	4 × 10⁻⁴ Hz path only; nil in REM
Plant & sensor roles	Present	Present, more heavily instrumented
Who corrects an error	The occupant, in real time	The machine, or nobody in time
Correcting bandwidth	< ~4 Hz	0.02–0.3 Hz
Safety strategy	Passivity and bounded impedance	Feedforward gate plus hardware envelope
Actuation slow because	Reflex band must not be excited	Substitute loop cannot keep up
Safety authority	Shared; occupant retains override	Frozen Critic; occupant has none
Recourse if sensing dies	Yes — they can push back	None
The wrong assumption	That the user will not fight it	That the user will react in time

Figure 09 / One question, two architectures

Figure 09. The two architectures are not competing philosophies. They are the two answers to one question, and the question is answered by physiology rather than by preference.

Every row below the first is a consequence of the first. Flow can be a shared-authority system because the occupant is a functioning controller; the work is to avoid destabilising them. Cama cannot, because the only controller present operates four orders of magnitude too slowly; the work is to supply a faster one.

Which is also why Cama's safety architecture should not be ported to Flow. A frozen feedforward arbiter gating every command makes sense when nothing downstream can correct in time. Apply it to a chair and you are overriding a competent human controller who has better information than the machine about what their own body wants.

Sohan reached the same conclusion from mechanism design rather than control theory, two products and a year earlier: the bed has to move the way the body moves, at the same point, about the same axis, through the same arc, and any deviation is absorbed by the human.^H That is this article's thesis stated as kinematics.

§ 06

Where the two products meet

The axis is continuous, and our products are not the only things that move along it.

People fall asleep in chairs. Flow's occupant is awake and working right up until they are not, at which point a machine architected for a strong compensator is operating on a weak one. The transition band is exactly where K_c is neither high nor zero and is changing on a timescale comparable to Cama's slowest engineered path.

Cama has the same problem in reverse. A sleeper surfacing toward waking passes back through the band, and for a period the machine acts on a partially available compensator whose gain it cannot measure directly.

Current mitigation on both products is conservative dwell — the system does less near detected transitions. That is a mitigation, not a model.

§ 07

What we have not solved

We do not measure compensator gain, we infer it

Everything above treats K_c as the governing variable, and we have no direct estimate of it. Sleep stage is a proxy; arousal threshold is a proxy for a proxy. A user whose postural loop is impaired — spinal cord injury, advanced neuropathy, deep sedation — sits in Cama's operating region with a different K_c than a healthy adult in N3, and the machine cannot currently tell them apart. The pressure injury literature suggests this population needs the product most.⁸ It is also the population our safety case covers least well.

Pharmacology moves the engineered channels in opposite directions

We assumed medication would uniformly reduce autonomic feedback gain. It does not, and the reality is worse. Beta blockade blunts chronotropic response — the fast HR path we use for per-action correction — while raising time-domain HRV, the slow path, by improving vagal modulation.¹⁵ Diabetic cardiac autonomic neuropathy reduces HRV broadly and often asymptomatically.¹⁶ Anticholinergics suppress vagal markers. A scalar "signal quality" flag cannot represent one channel gaining while another loses. The Validator needs per-channel gain estimates and a margin that degrades when either does. It does not have them.

Two bodies, one autonomic channel

Two plants sharing one feedback sensor is an observability problem without a clean solution absent a second independent channel. Pressure ID already flags the adjacent version of this — out-of-label bodies that resolve to a registered user because nothing in the feature space says otherwise.^I Temporal separation, dwell windows and identity reassessment bound the problem rather than solve it.

Nobody has published the transfer function we need

McRuer's data is awake pilots at a control stick. Sleep research measures arousal thresholds and event-related responses, not operator gain and phase. There is, as far as we can find, no quasi-linear human describing function parameterised by sleep stage — because until recently no product needed one. Figure 05 is drawn from the direction and magnitude of published findings. It is not measured, and we would like it to be.

Passivity for a distributed compliant surface

The Z-width analysis grounding passivity in haptics is one degree of freedom against a hand, and finds inherent physical damping to dominate the achievable impedance range.⁷ Flow has fifteen degrees of freedom through a shared transmission; Cama has forty-two coupled actuators under a compliant mattress against a body of unknown, time-varying impedance. Abdul's spring modules show the principle works locally on the surface layer.^B What the equivalent condition is for the full array is not obvious to us.

The machine is not the system. The system includes a person, and you do not get to choose whether they are in the loop — only which part of it they can reach.

Flow's occupant reaches the compensator, and the chair is built not to destabilise them. Cama's sleeper reaches it too, at 1.6 corrections an hour, each one paid for in fragmented sleep. The bed exists to get there first. The hardware ceiling, the frozen arbiter, the physiological validator and the multi-rate reward are not four independent safety decisions. They are four consequences of one loop that had to be rebuilt because the original runs too slowly to protect the person running it.

Cama is a physically adaptive sleep system with 10,752 pressure sensors and real-time posture inference. Flow is a fifteen-degree-of-freedom adaptive chair. Both are built by Water Robotics. If you work on human-in-the-loop control, sleep physiology or interaction safety, we would welcome the conversation — science@waterobots.com

Appendix

Prior work in this series

Multiplexing Mechanical Power: The Case for Fewer Motors in High DoF Robots — Sohan Naraparaju, 20 Feb 2026. Flow's two-motor powertrain and the switching-rate-versus-stability-time-constant condition this article reuses for sensing.
Flat Force Across a Moving Surface — Abdul Hannan, 26 Nov 2025. Constant-force spring tensioning; the passive-element argument.
Nobody Is Vouching For Your Body — Teja Vinukollu, 25 Apr 2026. Nocturnal repositioning rate, the arousal cost of each shift, and spine debt.
The Fourth Law — Teja Vinukollu, 22 Apr 2026. The Class 1–6B ladder and the awareness axis.
Physical Intelligence, Safely — Teja Vinukollu, Apr 2026. The Actor–Critic–Validator architecture, the 10 mm/s ceiling, the isolated biological sensing domain, and the multi-rate reward.
The Mattress as an Inverse Problem — Sai Harsha & Kaushik Kalva, 13 Oct 2025. Deborah number selection and the temporal component of the sensing path.
From If-Cases to Language Models — Kaushik Kalva, 20 Apr 2026. Semantic compression, the post-LLM constraint layer, and the detect/act split.
The Pivot Problem Nobody Talks About — Sohan Naraparaju, 2 Sep 2025. Remote centre of motion, and the mechanical statement of this article's thesis.
Pressure ID — Kaushik Kalva, Sagar Tetali & Teja Vinukollu, 9 Jul 2025. Identity inference from pressure, and the out-of-label limitation.