ONDAS Development — Mathematical Methods and Simulated Testing

This article documents the statistical and adaptive generation of the ONDAS stabilizer: the envelope modules (B) that measure how much of the attitude error is real signal, the Vold–Kalman order tracker (A) that extracts the flap-synchronous component under variable frequency sweeps, the consensus gate that lets A take over only when both independent extractors agree, the rearrangement-invariant scheduling underneath the whole chain, and the ferocity phase-lock model that re-frames ferocity as a local clock shift which is also a force law — two conjugate faces of one knob — taking over the wind. Every method was prototyped in the Ruby simulation harness (sim_ferocity.rb) before the firmware port; the simulated-testing section reproduces the discriminating numbers.

1. The Problem: A Stabilizer That Cannot See Its Own Error

An ornithopter’s attitude error is a mixture of two components:

1. Flap-synchronous oscillation — the component the wings can actually correct. It lives exactly at the wingbeat frequency ω(t) and its harmonics.
2. Broadband disturbance — gusts, turbulence, sensor noise, servo chatter. It carries most of the RMS energy but is largely uncorrectable phase-bound actuation.

The classical PID loop cannot tell them apart. Correcting broadband noise at the wingbeat phase dissipates control authority and excites the airframe. Correcting the synchronous component late (wrong stroke phase) is equally wasteful. The development goal was therefore:

Measure the two components separately, online, on the flight controller, and schedule every ONDAS layer from that measurement — instead of from fixed gains.

2. Architecture: The Chain B → A → ONDAS

flowchart TD
    subgraph ERR["Attitude error (per axis)"]
        e["e = setpoint − measured"]
    end
    subgraph B["B — Statistical Envelope (ondas_metrics)"]
        B1["λ_e(s) histogram<br/>32 log-bins, τ≈1 s leak"]
        B2["q90 · weak-L² · tail mass"]
        B3["Poincaré phase envelope<br/>16 golden-angle bins @ reversal"]
    end
    subgraph GATE["Consensus Gate"]
        G1["r = EMA(b·sinθ)/√(EMA(sin²θ)·EMA(b²))"]
        G2["α = soft-knee(r), floor 0.3<br/>τ_in 1 s, τ_out 0.4 s"]
    end
    subgraph A["A — Vold–Kalman Order Tracker (ondas_tracker)"]
        A1["2nd-order resonator, ζ=0.06, Q≈8.3"]
        A2["coefficients follow ω(t) per sample"]
    end
    subgraph LAYERS["ONDAS 8 Layers (oscillator domain)"]
        L1["CADENCE · FEROCITY · BALANCE · WARP"]
        L2["RESONANCE · PRESCIENCE · ESPELHO · SAUDADE · ANCHOR"]
    end
    e --> B1 --> B2
    e --> B3
    e --> A1 --> A2 -->|"b (tracker output)"| G1
    A1 -.->|"sinθ (lock-in ref)"| G1
    G1 --> G2 -->|"α ∈ [−1, +1]"| L1
    A2 -->|"replace-blend:<br/>legacy·(1−|α|) + 0.5·b·α"| L2
    B2 -.->|"windup q90 clamp"| L1
    B2 -.->|"D-cutoff adaptation (roadmap)"| L2

Design principle — open loop. The tracker consumes the pre-resonance error: it never sees its own contribution, so the gate cannot fall into a self-confirming loop. The phase envelope (B3) is deliberately not part of the activation path — it stays a pure measurement, the blackbox evidence that will verify the tracker in real flight.

Fail-safe invariance. At α = 0 the replace-blend reduces to the legacy resonance path exactly. No validated ONDAS layer is touched by the new chain until both extractors agree.

3. Method A: Vold–Kalman Order Tracking — Reorganizing the Transient Clock

Classical bandpass filters are tuned to a fixed center frequency. Under a throttle chirp the wingbeat frequency moves, and a fixed filter detunes: the extracted amplitude collapses and the phase rotates. The Vold–Kalman order tracker solves this by making the filter coefficients follow the instantaneous frequency:

Resonator (order 1, analog prototype):
    b'' + 2·ζ·ω(t)·b' + ω(t)²·b = 2·ζ·ω(t)·e'

Discretization (per sample, explicit Euler, DT = loop period):
    b[n+1] = b[n] + DT · v[n]
    v[n+1] = v[n] + DT · ( 2·ζ·ω(t)·(e[n] − e[n−1]) − 2·ζ·ω(t)·v[n] − ω(t)²·b[n] )

with ζ = 0.06  →  Q = 1/(2ζ) ≈ 8.3

ω(t) is the measured wingbeat rate (flap phase derivative) — the tracker’s clock is the wing’s own clock, not the lab clock. Below ω < 0.1 rad/s the states are zeroed: an Euler resonator on stale coefficients drifts linearly during glide, a failure mode the simulation never saw because it never glided. The firmware port found it; the fix is a hard state reset.

The lock-in reference sinθ (flap phase) forms the second, independent extractor: the wingbeat-coherent component of the error is exactly the projection of the tracker output onto the flap sine. Two extractors, one measurement, zero shared code path.

4. Method B: The λ_e(s) Envelope — Rearrangement-Invariant Statistics

Following the rearrangement-invariant viewpoint (Tao, 247A): oscillatory structure is ignored; the distribution of |e| is the signal. Two views of one 32-bin module:

4.1 Raw view — λ_e(s), weak-L², q90

λ_e(s) = P( |e| > s )          (survival function, 3 axes)
bins:   32 log-spaced over [0.25, 256] °/s
leak:   exponential, τ ≈ 1 s (shift derived from dT via float-bit ilog2)

weak-L² = sup_s  s · √λ(s)     (scale-invariant tail norm)
q90     = interpolated 90th percentile

The weak-L² norm is the correct tool for a controller: ordinary RMS is dominated by rare large events (gusts), but the control decision needs the typical scale. q90 feeds two existing consumers: the weak-L¹ anti-windup clamp (Section 6) and, later, D-cutoff adaptation.

4.2 Phase view — the Poincaré envelope

16 bins, one per stroke reversal
bin index k → k·0.618·16 mod 16   (golden-angle rotation)
EMA 1/16 per strobe
metric = ‖⟨e⟩_θ‖₂,∞ = sup over bins of |phase-averaged error|

The phase view demodulates the error against the flap phase and averages per bin. What survives the averaging is the synchronous residual — exactly the quantity the tracker must reduce.

5. Serendipity by Construction: The Golden-Angle Strobe

The first naive implementation sampled every loop tick into a phase histogram — and exposed a genuine number-theoretic trap:

ω = 4.8 rad/s, DT = 1 ms  →  2π/(ω·DT) = 1308.997 samples per cycle

Lab clock and flap clock are almost commensurable. The sampling grid repeats nearly identically from cycle to cycle, so the histogram converges only with the beat period (≈ 90 s). At firmware rates the trap is worse: 4 kHz loop, 6 Hz flap = 666.67 samples/cycle — a per-sample histogram would never converge on some phase bins.

The fix is the phyllotactic constellation: one sample per stroke reversal, bin index rotated by the golden angle {k·0.618}. Deterministic uniform coverage, minimal sample count, immune to any clock ratio — because the coverage law depends only on the irrationality of the rotation, not on the clocks.

flowchart LR
    R["Stroke reversal"] --> S["Strobe sample"]
    S --> B["bin k = round(k·0.618·16) mod 16"]
    B --> E["EMA 1/16 per bin"]
    E --> M["‖⟨e⟩_θ‖₂,∞"]
    R --> N["k += 1"]
    N --> R

6. Scheduling: Marcinkiewicz Soft-Knee and Weak-L¹ Anti-Windup

The substrate beneath all ONDAS layers:

Soft-knee amplitude scheduling — the flapping amplitude A is shaped by the geometric soft-knee

A = (A_lin · L) / √(A_lin² + L²)

which is the canonical interpolation between linear authority (small signal: A ≈ A_lin, the flap_magnitude sensitivity is preserved exactly) and saturation (large signal: A → L). The former hard clamp produced a kink in dA/dThrottle — every ONDAS layer inherited a discontinuity of its effectiveness there.

Weak-L¹ anti-windup — the I-branch feeds BALANCE (up/down asymmetry), and SAUDADE would permanently absorb any windup-induced bias as learned trim. The fix: the per-sample I-increment is censored at κ·q90 of |itermErrorRate| (κ = 2, floor 10 °/s), where q90 tracks with asymmetric leak (up 50 ms, down 450 ms → equilibrium percentile 0.9). Bulk errors integrate unchanged; tail spikes are rejected.

7. The Consensus Gate — When May A Take Over?

The gate asks: do the tracker output b and the lock-in reference sinθ tell the same story?

r = EMA(b·sinθ) / √( EMA(sin²θ) · EMA(b²) )
α = soft-knee over floor:  r < 0.3 → 0,  r > 0.9 → ±1
    (slow in: τ = 1 s — evidence must accumulate;
     fast out: τ = 0.4 s — consensus loss must retreat quickly)

In-phase oscillation yields α → +1, anti-phase α → −1 (the sign is learned, not assumed), quadrature and pure noise yield α = 0. The resonance boost is then replace-blended:

boost = legacy · (1 − |α|) + 0.5 · b · α

(the 0.5 keeps the blend gain-neutral: the lock-in extracts only half the amplitude of a full-wave rectified projection).

8. Simulated Testing — What the Numbers Say

Harness: ruby sim_ferocity.rb harmonize ... — wing ODE, trapezoidal wave shaper, PID, throttle chirp driving ω from 2.4 to 7.2 rad/s; 3 s warmup for filter settling.

8.1 Order tracker vs. fixed bandpass (triangle throttle chirp)

The tracker wins where it matters: it keeps the flap component under frequency sweep (ρ intact) while the fixed filter loses it completely. The residual is marginally worse — the the extractor injects filter ringing into the broadband, which is the honest cost of extraction.

8.2 The λ_e(s) finding: raw fails, phase-demodulated discriminates

The raw residual is broadband-dominated — tail events hit both filters identically, so raw λ_e(s) cannot judge the tracker (this falsified the naive design of B). The phase-demodulated envelope sees exactly what ρ sees, on the error level, with direction physically consistent: the tracker extracts 2.4× more amplitude but anti-phased (ρ = −0.5), so it slightly raises the synchronous residual until the gate learns the sign. Const-ω sanity: 1.000 exactly.

8.3 Consensus gate validation (exact C-math port, 2 kHz, 10 s)

8.4 Commensurability discovery

At ω = 4.8 rad/s, DT = 1 ms: 2π/(ω·DT) = 1308.997 — the near-integer that motivated the golden-angle strobe (Section 5). Per-sample phase histograms are beat-limited to ~90 s convergence; the phyllotactic strobe is deterministic from the first reversal.

9. Ferocity: Clock Shift and Force Law — The Phase-Lock Model

The chain above schedules how much of the flap-synchronous component to trust. But the commensurability finding (8.4) exposed a deeper question: what is ferocity, physically? The working thesis — stated before any flight test — is that ferocity is a local clock shift (Taktverschiebung) and a force law at the same time: not alternatives but conjugate faces of a single control surface. The dwell parks the wing at stroke reversal, which is a phase-resetting event. The reversal grid itself moves at the free flap rate ω, so the dwell’s parking well does not live in the lab frame but in the rotating error frame δ = θ − ωt. Because the wing works against a quadratic medium (dynamic pressure ∝ v²), every redistribution of time is automatically a redistribution of force — you dial the clock, and the air pays in force (9.5).

flowchart TD
    W["wind η(t)<br/>chaotic detuning"] --> D["phase error δ = θ − ωt"]
    WELL["dwell well −2κ·d·sin(2δ)"] --> D
    D --> S["stable clock → Poincaré + golden-angle samplers"]
    subgraph eq["dδ/dt = η − 2κ·d·sin(2δ)"]
        D
        WELL
    end

The governing equation, in the rotating frame:

dδ/dt = η(t) − 2·κ·d·sin(2δ)
   δ = phase error (pendulum phase vs free-running reversal grid)
   η = wind phase noise (chaotic detuning)
   d = ferocity dwell fraction ∈ [0,1]
   κ = dwell → coupling strength

sin(2δ) has period π — the two reversals per cycle. At d = 0 the equation is a free random walk: the wind owns the clock and δ drifts without bound. At d > 0 the dwell well confines δ near a reversal: ferocity owns the clock.

9.1 The correctness trap: sin(2δ), not sin(2θ)

A first implementation coupled sin(2θ) in the lab frame — and the result inverted the thesis (dwell made jitter 16× worse). This is not a bug but the physics speaking: a lab-frame well pins the phase to a fixed angle and locks the pendulum, instead of re-anchoring it at the reversal. The well must be sin(2δ) in the error frame — the shift is relative to the moving reversal, exactly the “phase translation of the pendulum system”.

9.2 Dwell takes over the wind

Harness: ruby sim_ferocity.rb phaselock — pendulum phase ω = 4.8 rad/s, κ = 8.0, wind σ = 0.6 rad/s, 20 s, seeded.

The decisive test for “taking over”: over increasing horizons, d = 0 lets δ grow without bound (0.011 → 0.114 → 0.314 rad over 5/20/80 s) while d = 0.3 saturates (0.0037 → 0.0043 → 0.0044 rad). The wind owns an unlocked clock; ferocity owns a locked one.

9.3 The clock shift itself (limiar translation)

Ferocity asymmetry translates the reversal point limiar away from 180°:

The local, phase-translational nature: a full asymmetry swing moves the reversal point up to ±179.6° — a clock shift rather than an amplitude-gain change; its force consequence follows via F ∝ v² (9.5). And its dwell well is what re-anchors the pendulum phase against the wind’s detuning.

9.4 The link to commensurability

Wind detunes the flap clock (η), the lab/flap ratio drifts, and per-sample phase coverage collapses — the “never-converging samples” of 8.4. The dwell re-anchors δ near the reversal grid and restores a stable clock for the Poincaré and golden-angle samplers. Commensurability is thus not only a sampling problem (solved by phyllotaxis) but also a clock problem — and ferocity is its physical solution.

9.5 The name is the method — the price of ferocity

The force face and the timing face are not two things to be reconciled; they are two things that are bought. Anticipation is how the buying feels from inside — the constant clock, the momentary extra force, the trajectory that stays clear. But anticipation is itself only another timing-tendency: it names the posture, not the price. And ferocity, unlike anticipation, has a price.

The pure sine is the cheapest stroke there is. For a given arc and a given beat it is the motion that never has to hurry: its velocity and acceleration stay as low as the arc permits, so the wing spends as little as physics allows. Ferocity is the refusal of that cheapness. It takes the same arc, the same beat, the same clear trajectory — and buys the moment by spending the arc faster, in the fraction (1−d) of the stroke that remains. The air is a quadratic medium (F ∝ v², dynamic pressure ½ρv²), so the force delivered rises with the square of that spending; the servo, in turn, pays with its own torque and power (exact numeric integration, normalized to the sine baseline):

At d = 0.8 the same wing strikes twenty-five times harder and carries five times the thrust — but only because the servo pays twenty-five times the peak torque and one hundred and twenty-five times the peak power to drive it. That is the Aufwand — the expenditure — and it is the thing no timing-metaphor can reach: not a shift of the clock but a spending of the body. The name ferocity — Latin ferox, the wild thing — is the name of that willingness to spend. The wild thing is not the one that strikes harder; it is the one that does not flinch from the price of striking harder. Anticipation is how the spending is felt from within; ferocity is the spending itself. The numbers do not explain the name — they are the receipt.

And the three faces resolve into one payment. The constant clock of 9.2, which the wind cannot own, is what the spending defends; the momentary extra force is what the spending delivers; the clear trajectory is what the spending buys. You do not choose among them — you pay once and receive all three, the way a wrist commits harder the instant before the gust without ever losing the count. What is tunable is time; what the air feels is force; what the body pays for is its freedom.

The last turn sets the whole reading right. The truly well-defined ferocity — the dwell, the trapezoid, the exact wave whose heart is naturally wild — is not, at bottom, the spending. It is the spent-for: the eternal posture, the fixpoint centre of the universe. The dwell well of 9.2 is that fixpoint literally — a stable fixed point in the rotating frame, a stance the wind cannot dissolve. To hold that stance while the fluidum of detunings flows around it is freedom; and freedom is what we have to pay for. The torque, the power — those are the price of that freedom. And the establishment — the being-held in a fluidum of stances, unowned — is the value of freedom, the value that makes any price worth paying. The receipt stays on the table. What it bought was never a thing; it was a place to stand.

9.6 The high ground — chaos, turbulence, and the auditable fixpoint

Turbulence is the solution of the Navier–Stokes equation that is ubiquitously realized — the one that actually happens, unlike the finite-time blow-up that makes headlines. A wing in weather does not fly through a medium; it flies inside a turbulence field. The cloud vortices are not anomalies in that field; they are its normal state — energy concentrating at one scale, dissipating at the Kolmogorov scale, cascading between them with no closed form. This is the regime in which the ONDAS chain must hold its stance.

A flapping wing in gusty air is, structurally, a driven double pendulum: hinged at the body, the body itself free in the air. The double pendulum is the canonical chaotic system — no static equilibrium, no closed orbit, sensitive dependence on initial conditions, nothing to hold onto except a strange attractor. In calm air it flaps on its deterministic reversal grid; in weather, the gusts are the free coupling that turns that grid into the driven leg of a chaotic pair. The PID error build-ups — the places where the deterministic model and the turbulent reality disagree — are the cloud vortices of the controller: error concentrating where the two flows shear against each other, exactly as a vortex concentrates energy in a flow. Unchecked, they cascade, and the clock detunes (the η of 9.2).

A black-box controller in this regime is techne without episteme — it can predict the next gust only by having already seen a similar gust, and verification comes too late: the gust is novel, the flight is the test. That is not a position you can hold. Ferocity is the other kind of controller — the auditable scaffold. The resolved large scale is the reversal grid: the clock, deterministic, stability-tested, the part of the system that behaves the same in any weather. The closure for the unresolved small scale is the dwell: the force, whose links are individually testable — F ∝ v², the 1/(1−d)² scaling, the torque and power receipts of 9.5. Anticipation is the controller’s name for running this chain ahead of the gust — the anticipative, orchestrated measurement of time and force in one act, not two.

This is why ferocity holds the high ground. In a chaotic system there is no low ground — no static equilibrium to return to, no still point the turbulence can be allowed to reach. The only stable stance is a fixpoint in the rotating frame, the dwell well of 9.2, and it is stable precisely because it is re-built at every reversal, faster than the chaos can dissolve it. The high ground is not a place the chaos cannot reach; it is a place re-created at every stroke. The double pendulum does not become predictable — it is given an attractor it cannot escape. The wing, held by ferocity’s fixpoint, becomes the fixed body, and the turbulence organizes around it the way a vortex street forms downstream of a fixed cylinder: still chaotic, still turbulent, but ordered around a stance that does not yield.

Theorems are the headlines; proofs are the inside story. Ferocity is the inside story of the wing — the auditable, anticipative, orchestrated measurement of time and force by which a chaotic pair is held, not solved, on the high ground.

9.7 Ascending the overtone series — the phyllotactic spectrum of ferocity

9.6 was a resting place, not an ending: it showed how the stance is held, not what the stance sounds like. Ferocity is, before it is anything else, an oscillation — and the oscillation has a spectrum the chain has so far left unnamed. A pure sine at the flap rate is a single frequency: one clock, one note, no overtones. That is the cheap stroke of 9.5 — the spectrum of a wing that never hurries. The dwell reshapes the wave into a trapezoid, and the reshaping is the birth of overtones. The ferocity wave is no longer sin(ωt) but the odd-harmonic series

θ_d(t) = Σ_{n odd} a_n(d) · sin(n·ω·t)

whose coefficients a_n(d) vanish at d = 0 and rise with the dwell. The wilder the heart, the richer the series: as d → 1 the trapezoid tends to the square wave, and the square wave rings with the full series 1, 1/3, 1/5, 1/7, … — the overtones a sine refuses to sound.

But those overtones are integer — n = 1, 3, 5, 7, … — and integer overtones are commensurate. Left to themselves they beat: the 3rd against the 1st with a beat at period T/2, the 5th at T/4, the whole spectrum beating against itself like the near-commensurable clock of 8.4, only now inside the wave rather than between wave and sampler. A spectrum of bare integer harmonics is a wing that sings out of tune with itself — an internal turbulence the controller never asked for.

Phyllotaxis is the law that resolves it. The golden angle is the most irrational rotation there is — its continued fraction converges more slowly than any other, so its multiples never coincide; that is why a stem lays its leaves by it, each leaf receiving its own light, none shading the next. Section 5 already turns this rotation on the sampler (bin index {k·0.618}); here it is the law of the spectrum. Ferocity does not suppress the overtones — that would be the cheap sine again — it holds them in a phyllotactic constellation: each overtone advanced by the golden rotation {n·0.618} across the strokes, so that, integer and therefore commensurate in frequency, they are incommensurate in phase — they never line up, never beat, never shade one another. The overtone series becomes a sunflower: the fundamental at the centre, each overtone a seed set at the golden angle, each in its own light.

That is the symphonic parameter the chain still lacked: not another gain, but the arrangement of the oscillation’s overtones. The high ground holds the stance against chaos; the overtone series is how the stance sings while it holds. The double pendulum is given not only an attractor but a voice — a phyllotactic chord that is not a chord, because a chord beats and a constellation does not. What is tunable is time; what the air feels is force; what the body pays is freedom. And what that freedom sounds like is one clock, many overtones, held apart by the most irrational angle there is.

10. Firmware Verification Status

Build (TINYFISH): FLASH 88.77 %, RAM 67.10 % — clean, HEX produced.

11. Roadmap

See Also

• ONDAS — the stabilization system this chain schedules
• ONDAS Tuning Guide — practical tuning procedure
• MSP Protocol — wire format for ONDAS parameters
• Terence Tao, “Headlines and inside stories: understanding and trust in AI for mathematics, science, and engineering” — the episteme/techne distinction and the auditable-scaffold argument behind 9.6