SAFETY-48: the slew step ceiling reaches the integrator, and what it bounds is the LEAD
`compute()` freezes the integrator with an asymmetric rule and the comment beside it states the requirement outright - "the requirement is that the INTEGRATOR stop accumulating, not only the command" - but `frozen` is computed from ONE signal, `abs(prev_w - actual_w) > saturation_w`, and slew-limiting never enters it. The integrator moves `gain * error` a cycle and the command moves at most `slew_w`, so the integrator outruns the command whenever `|error| > slew_w / gain`: 667 W at the live shape, against a measured median grid error of 1114 W at the onset of a recorded episode. SAFETY-39's retune made it MORE frequent, not less - a smaller step is a lower threshold. ⚠️ THE FORM THE CARD ASKED FOR RAISES THE BILLED QUANTITY, WHICH IS WHY IT IS NOT WHAT SHIPPED. Reusing the asymmetric freeze on a carried slew flag was built from release/1.0's own source and measured over 16.00 days / 256 252 meter instants of the live install's recorder: export 39.61 -> 34.43 kWh, and the worst quarter-hour average OFFTAKE 3739 -> 3935 W with the mean quarter +2.73 W, in five of six plant and tuning variants. A frozen integrator stops at `prev + gain*error`, which undershoots by (1 - gain); for an export that is free and for an import it is offtake, for as long as the ramp lasts. The card said "do not invent a second rule"; the measurement says to, and both sentences are recorded. WHAT SHIPS BOUNDS THE LEAD AT ONE SLEW STEP, inside the branch where the slew actually bound. Same 16 days, same ticks, same disturbance, same plant, same seed: export 39.61 -> 34.07 kWh, wasted throughput 4.67 -> 3.19 kWh, battery sign reversals 2992 -> 2770, median recovery 232 -> 199 s, p99 849 -> 850 s, max 901 -> 898 s, unrecovered 53 -> 31, worst |i_w - prev_w| 9200 -> 800 W - and the worst 15-minute average offtake 3739 -> 3434 W, i.e. the billed quantity IMPROVES. `i_w = slewed` (a cap of zero) is better again at 32.02 kWh and is refused: it is the velocity form this module's docstring says `i_w=None` collapses to. TWO COMMITTED NUMBERS MOVED, DELIBERATELY, WITH THE REASON BESIDE THEM. SAFETY-13's released command settles at -800 W and -1200 W where release/1.0 settled at -1190 W and -2390 W, because there is less wound integrator to settle onto; AC 4's property - it stops at the frozen integrator, not the rail - is what is asserted and the second is now graded against `i_w` rather than a literal. And SAFETY-39's "the slew does not own the over-absorption" is now FALSE - INVERTED, on the independent first-order plant test_control.py writes itself: 1005/1109/1285/1330 W rising with a slower slew becomes 729/550/424/326 falling. Two plant models that share nothing agree on the sign. Evidence: `tools/replay_recorded_loop.py` plus the read-only capture it made (scenarios/loop-2026-09-02_2026-09-17). The "before" law is the shipped file with the block removed by a named substitution - never a transcription - and a missing anchor is a REFUSAL carrying "NOTHING HAS BEEN MEASURED". The instrument prints its own fidelity first: it reproduces 39.6 kWh of export where the install exported 29.4, i.e. it is ~35 % pessimistic about the loop's tracking, so only the delta is claimed. 30/30 suites green, including test_control.py's exhaustive i_w=None equivalence sweep against the transcribed release/1.0 law, untouched: the cap moves `i_w` and not `target`, and that sweep compares (target_w, sat_count, frozen, reason). Six law mutations, one instrument battery. L4 - the cap applied unconditionally, -92 B - was a SURVIVOR of all thirty files: it is bit-identical on the shipped configuration (0 of 256 246 ticks) and separable on 2050 of 257 400 swept states, all at `integrator_max_w` above `max_w`, which part 4 now drives. L5 and L6 are ZERO BYTES. AND TWO COMMENTS IN THIS CARD WERE INVENTED AND ARE CORRECTED IN PLACE. The one-sided spelling was justified by a two-sided form that would "drag a trailing integrator" - it does not, and the two agree on 205 920 of 205 920 swept states; and a "118 of 256 252 ticks" figure had been measured against a different pair. MUTATION.md gains habits 21 and 22 for both shapes. NOT DEPLOYED, NOT VERSIONED. The live install still runs release/1.0's law. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU
This commit is contained in:
glenn schrooyen
co-authored by
Claude Opus 5
Claude Opus 5
parent
b6c6da31d8
commit
03ef61fa3b
@@ -191,6 +191,68 @@ SETTLE_CYCLES = math.ceil(PLANT_SETTLE_DOWN_S / LOOP_TICK_S) # 12
|
||||
# edge rather than in prose, because it is a property of two files agreeing.
|
||||
_SAT_COUNT_CAP = SETTLE_CYCLES + 1 # 13
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# SAFETY-48. HOW FAR THE INTEGRATOR MAY STAND AHEAD OF THE COMMAND.
|
||||
#
|
||||
# ⚠️ THE MISSING CASE, AND IT IS A CASE AND NOT A CONSTANT. The freeze below
|
||||
# stops the integrator accumulating, and the comment beside it says what the
|
||||
# requirement is: "the INTEGRATOR stop accumulating, not only the command". But
|
||||
# `frozen` is computed from ONE signal - `abs(prev_w - actual_w) >
|
||||
# saturation_w`, the inverter not tracking - and SLEW-LIMITING NEVER ENTERS IT.
|
||||
# When the command hits the step ceiling, the integrator goes on winding at
|
||||
# `gain * error` until it reaches `integrator_max_w`.
|
||||
#
|
||||
# The arithmetic, and it is the whole card:
|
||||
#
|
||||
# the integrator moves gain * error per cycle
|
||||
# the command moves at most slew per cycle
|
||||
# so the integrator outruns the command whenever
|
||||
#
|
||||
# |error| > slew / gain
|
||||
#
|
||||
# At the live install's shape (gain 0.6, slew_w 400) that is 667 W. The median
|
||||
# grid error at the onset of a recorded episode is 1114 W. This is why
|
||||
# SAFETY-39's `slew_w` retune did not fix it: a smaller step makes the
|
||||
# threshold LOWER, so the case fires more often, not less.
|
||||
#
|
||||
# ⚠️ WHAT IS BOUNDED IS THE LEAD, NOT THE INTEGRATOR. Two forms were measured
|
||||
# over 15.7 days of the live install's own recorded disturbances
|
||||
# (`tools/replay_recorded_loop.py`, and DECISIONS/SAFETY-48 has the table):
|
||||
#
|
||||
# (a) reuse the asymmetric freeze on a carried slew flag - "may not wind
|
||||
# further in the direction it is already pushing", exactly as saturation
|
||||
# does. It cuts export 13 % AND RAISES THE BILLED QUANTITY: the worst
|
||||
# quarter-hour average OFFTAKE goes 3839 -> 3935 W and the mean quarter
|
||||
# moves +2.7 W, in five of six plant and tuning variants. A frozen
|
||||
# integrator stops at `prev + gain * error(first cycle)`, which UNDER-
|
||||
# shoots what the site needs by (1 - gain), so a large import is answered
|
||||
# too weakly for as long as the ramp lasts. That is the wrong trade on a
|
||||
# capacity tariff and the reason this is not that fix.
|
||||
#
|
||||
# (b) cap how far the integrator may LEAD the command, one slew step. Export
|
||||
# 39.8 -> 34.1 kWh, wasted throughput 4.7 -> 3.2 kWh, sign reversals
|
||||
# 3050 -> 2806, worst quarter-hour offtake 3839 -> 3434 W (it IMPROVES),
|
||||
# median recovery 237 -> 214 s. It is what ships.
|
||||
#
|
||||
# ⚠️ AND THE CAP IS NOT ZERO. `i_w = slewed` is full back-calculation, and this
|
||||
# module's own docstring says what that costs: passing `i_w=None` "reduces this
|
||||
# function to the exact velocity form it replaced". A zero cap makes `i_w`
|
||||
# identically the command on every cycle, which is that same collapse written
|
||||
# from the other end - it measures 32.1 kWh, better than (b) by 2 kWh, and it
|
||||
# throws away the reason the accumulator was split out at all. One step is the
|
||||
# smallest cap that is not that.
|
||||
#
|
||||
# WHAT THE NUMBER MEANS: the command can cover a one-step lead in ONE cycle, so
|
||||
# the worst-case unwind after a reversal is one cycle instead of
|
||||
# `integrator_max_w / slew_w` - 12.5 cycles at the live shape, ~60 s at the
|
||||
# meter's measured 4.84 s tick.
|
||||
#
|
||||
# ⚠️ IT IS IN STEPS RATHER THAN IN WATTS FOR SAFETY-39's REASON, WHICH IS THE
|
||||
# REASON THIS FILE KEEPS RE-LEARNING. A watt figure is a constant that outlives
|
||||
# the `slew_w` it was derived against; expressed in steps it moves with
|
||||
# `slew_limit_w()` and therefore with the rail.
|
||||
SLEW_LEAD_STEPS = 1
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class Tuning:
|
||||
@@ -507,6 +569,50 @@ def compute(
|
||||
slewed = max(prev_w - slew, min(prev_w + slew, target))
|
||||
if slewed != target:
|
||||
reason = "slew-limited"
|
||||
# --- SAFETY-48: the step ceiling reaches the integrator too ---------
|
||||
# ⚠️ INSIDE THIS BRANCH AND NOWHERE ELSE. The bound is on the lead the
|
||||
# SLEW created, so it is applied only where the slew is what stopped
|
||||
# the command. Applied unconditionally it would also pull the
|
||||
# integrator toward a command the SATURATION freeze is pinning - and
|
||||
# SAFETY-13's whole design is that the frozen integrator keeps standing
|
||||
# where it is, so that releasing the freeze buys the standing error
|
||||
# back. Measured over the recording, the two forms differ on 118 of
|
||||
# 256 250 ticks and agree on every reported figure to one decimal; the
|
||||
# narrow one is written because it is the one whose scope matches its
|
||||
# sentence.
|
||||
#
|
||||
# ⚠️ WRITTEN ONE-SIDED, AND IT IS **EQUIVALENT** TO THE TWO-SIDED BAND
|
||||
# `max(slewed - cap, min(slewed + cap, i_w))` - MEASURED, NOT REASONED.
|
||||
# An earlier draft of this comment claimed the two-sided spelling was a
|
||||
# bug that would drag a TRAILING integrator up toward the command. That
|
||||
# is false and the sweep said so: `target` is monotone in `i_w`
|
||||
# (`target = clamp(clamp(i_w, +-limit), +-max_w)`) and `slewed` is
|
||||
# `target` pulled toward `prev_w`, so whenever the slew binds, `i_w`
|
||||
# lies on the same side of `slewed` as `target` does and the other
|
||||
# clamp cannot reach. The two spellings agree on **205 920 of 205 920**
|
||||
# cases across four tunings, every sign of `prev_w`, `grid_w`,
|
||||
# `actual_w` and `i_w`, and the `i_w=None` path.
|
||||
#
|
||||
# It stays one-sided because it SAYS which side the lead is on - the
|
||||
# side the command wanted to move and could not - and because a reader
|
||||
# reaching for the band spelling should find the sweep rather than an
|
||||
# argument. ⚠️ The "descending" case is NOT an exception to the rule: a
|
||||
# command falling from +2400 W toward an integrator at +100 W has an
|
||||
# integrator 2300 W ahead of it IN THE DIRECTION OF TRAVEL, and it is
|
||||
# pulled back to one step beyond the emitted command exactly as a
|
||||
# rising one is.
|
||||
#
|
||||
# ⚠️ `i_w` IS CHANGED AND `target` IS NOT. This cycle's command is
|
||||
# already decided; what is bounded is what gets CARRIED. That is also
|
||||
# why the exhaustive `i_w=None` equivalence sweep in test_control.py is
|
||||
# untouched by this card: it compares `(target_w, sat_count, frozen,
|
||||
# reason)`, none of which this moves, and the seeded path re-seeds from
|
||||
# `prev_w` next cycle anyway.
|
||||
_lead_cap = SLEW_LEAD_STEPS * slew
|
||||
if target > slewed:
|
||||
i_w = min(i_w, slewed + _lead_cap)
|
||||
elif target < slewed:
|
||||
i_w = max(i_w, slewed - _lead_cap)
|
||||
target = slewed
|
||||
|
||||
if frozen:
|
||||
|
||||
Reference in New Issue
Block a user