admin/goodwe-addon
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

SAFETY-48: the slew step ceiling reaches the integrator, and what it bounds is the LEAD

Browse Source 
`compute()` freezes the integrator with an asymmetric rule and the comment
beside it states the requirement outright - "the requirement is that the
INTEGRATOR stop accumulating, not only the command" - but `frozen` is computed
from ONE signal, `abs(prev_w - actual_w) > saturation_w`, and slew-limiting
never enters it. The integrator moves `gain * error` a cycle and the command
moves at most `slew_w`, so the integrator outruns the command whenever
`|error| > slew_w / gain`: 667 W at the live shape, against a measured median
grid error of 1114 W at the onset of a recorded episode. SAFETY-39's retune
made it MORE frequent, not less - a smaller step is a lower threshold.

⚠️ THE FORM THE CARD ASKED FOR RAISES THE BILLED QUANTITY, WHICH IS WHY IT IS
NOT WHAT SHIPPED. Reusing the asymmetric freeze on a carried slew flag was
built from release/1.0's own source and measured over 16.00 days / 256 252
meter instants of the live install's recorder: export 39.61 -> 34.43 kWh, and
the worst quarter-hour average OFFTAKE 3739 -> 3935 W with the mean quarter
+2.73 W, in five of six plant and tuning variants. A frozen integrator stops at
`prev + gain*error`, which undershoots by (1 - gain); for an export that is
free and for an import it is offtake, for as long as the ramp lasts. The card
said "do not invent a second rule"; the measurement says to, and both sentences
are recorded.

WHAT SHIPS BOUNDS THE LEAD AT ONE SLEW STEP, inside the branch where the slew
actually bound. Same 16 days, same ticks, same disturbance, same plant, same
seed: export 39.61 -> 34.07 kWh, wasted throughput 4.67 -> 3.19 kWh, battery
sign reversals 2992 -> 2770, median recovery 232 -> 199 s, p99 849 -> 850 s,
max 901 -> 898 s, unrecovered 53 -> 31, worst |i_w - prev_w| 9200 -> 800 W -
and the worst 15-minute average offtake 3739 -> 3434 W, i.e. the billed
quantity IMPROVES. `i_w = slewed` (a cap of zero) is better again at 32.02 kWh
and is refused: it is the velocity form this module's docstring says `i_w=None`
collapses to.

TWO COMMITTED NUMBERS MOVED, DELIBERATELY, WITH THE REASON BESIDE THEM.
SAFETY-13's released command settles at -800 W and -1200 W where release/1.0
settled at -1190 W and -2390 W, because there is less wound integrator to
settle onto; AC 4's property - it stops at the frozen integrator, not the rail
- is what is asserted and the second is now graded against `i_w` rather than a
literal. And SAFETY-39's "the slew does not own the over-absorption" is now
FALSE - INVERTED, on the independent first-order plant test_control.py writes
itself: 1005/1109/1285/1330 W rising with a slower slew becomes 729/550/424/326
falling. Two plant models that share nothing agree on the sign.

Evidence: `tools/replay_recorded_loop.py` plus the read-only capture it made
(scenarios/loop-2026-09-02_2026-09-17). The "before" law is the shipped file
with the block removed by a named substitution - never a transcription - and a
missing anchor is a REFUSAL carrying "NOTHING HAS BEEN MEASURED". The
instrument prints its own fidelity first: it reproduces 39.6 kWh of export
where the install exported 29.4, i.e. it is ~35 % pessimistic about the loop's
tracking, so only the delta is claimed.

30/30 suites green, including test_control.py's exhaustive i_w=None
equivalence sweep against the transcribed release/1.0 law, untouched: the cap
moves `i_w` and not `target`, and that sweep compares (target_w, sat_count,
frozen, reason).

Six law mutations, one instrument battery. L4 - the cap applied
unconditionally, -92 B - was a SURVIVOR of all thirty files: it is
bit-identical on the shipped configuration (0 of 256 246 ticks) and separable
on 2050 of 257 400 swept states, all at `integrator_max_w` above `max_w`, which
part 4 now drives. L5 and L6 are ZERO BYTES.

AND TWO COMMENTS IN THIS CARD WERE INVENTED AND ARE CORRECTED IN PLACE. The
one-sided spelling was justified by a two-sided form that would "drag a
trailing integrator" - it does not, and the two agree on 205 920 of 205 920
swept states; and a "118 of 256 252 ticks" figure had been measured against a
different pair. MUTATION.md gains habits 21 and 22 for both shapes.

NOT DEPLOYED, NOT VERSIONED. The live install still runs release/1.0's law.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU
This commit is contained in:
glenn schrooyen
2026-09-19 02:36:28 +02:00
co-authored by Claude Opus 5
parent b6c6da31d8
commit 03ef61fa3b
72 changed files with 2297 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
goodwe_controller/test_control.py
+72 -21
View File
@@ -522,7 +522,20 @@ for _ in range(20):
pinned = [r for r in rows if r[3] == "saturated-freeze"]
check(f"non-zero prev_w, another writer: pinned at {pinned[0][1]:.0f} W...",
pinned and all(r[1] == -800.0 for r in pinned))
check(f"...then released, settling at {prev:.0f} W", prev == -2390.0)
# ⚠️ SAFETY-48 MOVED THIS NUMBER FROM -2390 W TO -1200 W, DELIBERATELY, AND
# THE PROPERTY IT IS HERE FOR IS UNCHANGED. The release lets the command walk
# to the FROZEN INTEGRATOR; SAFETY-48 bounds how far that integrator can have
# wound ahead of the command before the freeze engaged, so the value it walks
# to is smaller. What this run must still show is that the release happens and
# that it stops at the integrator - both asserted, the second against `i_w`
# rather than against a literal, because the literal is the half this card
# moves. The cost is stated rather than smoothed: on a persistent second writer
# this run buys back 1200 W of a 2000 W export where release/1.0 bought back
# 2390 W. DECISIONS/SAFETY-48 §5 records it as the price of the bound and the
# rejected alternative that avoids it.
check(f"...then released, settling at {prev:.0f} W, at the frozen integrator "
f"({i_w:.0f} W) - release/1.0 settled at -2390 W, at its own unbounded "
f"one", prev == -1200.0 and prev == i_w)
# --- 5. THE CARD'S OWN CASE, DRIVEN END TO END -----------------------------
# The live install's shape (max_w 5000, slew_w 400, target_grid_w -10). The site
@@ -546,9 +559,14 @@ check(f"the card's case: the charge starts at cycle {started[0]}"
# that divergence into windup. It cannot, because releasing the OUTPUT freeze
# does not release the INTEGRATOR freeze - so the command can only walk, one
# slew step per cycle, to a value the integrator stopped accumulating at.
# ⚠️ SAFETY-48 MOVED THIS ONE TOO, -1190 W -> -800 W against an integrator that
# stood at -1194 W and now stands at -800 W, for the reason above. AC 4's
# property - the release stops at the integrator and not at the rail - is what
# is asserted; the literal is the branch's own number and is printed.
check(f"the card's case: it settles at {prev:.0f} W, at the frozen integrator "
f"({i_w:.0f} W) and not the {TL.max_w:.0f} W rail",
prev == -1190.0 and abs(prev) <= abs(i_w) and abs(prev) < TL.max_w)
f"({i_w:.0f} W) and not the {TL.max_w:.0f} W rail - release/1.0 settled "
f"at -1190 W against an integrator of -1194 W",
prev == -800.0 and abs(prev) <= abs(i_w) and abs(prev) < TL.max_w)
steps = [abs(cmds[i] - cmds[i - 1]) for i in range(1, len(cmds))]
check(f"the card's case: no cycle moves more than the slew limit "
f"(worst {max(steps):.0f} W of {slew_limit_w(TL):.0f})",
@@ -1115,25 +1133,58 @@ check("⭐ FIXED, ON THE THING THE SLEW ACTUALLY OWNS: following the rail remove
_R["live"]["big"] > 0 and _R["rail"]["big"] == 0
and _R["interim"]["big"] == 0)
# ⚠️ AND WHAT IT DOES NOT BUY, MEASURED, ASSERTED, AND SAID BEFORE ANYBODY CAN
# READ MORE INTO THIS CARD THAN IT DELIVERED. `slew_w` bounds the OUTPUT; the
# integrator accumulates `gain * error` per cycle and is bounded only by
# `integrator_max_w`. At gain 0.6 into a 3.4 kW error the integrator moves
# ~2000 W per tick and reaches a 5000 W rail in under three ticks WHATEVER
# `slew_w` is. So the over-absorption is a GAIN term, and slowing the slew does
# not reduce it - on this model it gets slightly WORSE, because the command
# spends longer away from where it needs to be while the integrator keeps
# winding. admin/goodwe's rig, a different plant model, agrees: over-absorption
# 990 W at slew 1000 and 1086 W at slew 250, against 1010 W at gain 0.6 and
# 863 W at gain 0.3 (tools/slew_sim.py).
# --- SAFETY-48 RE-BASELINED THIS CHECK, AND THE INVERSION IS THE EVIDENCE ----
#
# `gain` is therefore the next constant to re-derive. SAFETY-39 measured it and
# CHANGED NOTHING: it is a live control-law constant on a running house, and two
# of them moving in one release makes the next measurement uninterpretable.
check("⚠️ THE SLEW DOES NOT OWN THE OVER-ABSORPTION, AND THIS CHECK IS HERE SO "
"THAT NOBODY READS SAFETY-39 AS 'THE OVERSHOOT IS FIXED'. Quartering the "
"slew from 1000 to 250 does not reduce the over-absorption at all",
_R["slower"]["over"] >= _R["live"]["over"])
# ⚠️ WHAT THIS LINE USED TO SAY, AND WHY IT IS NOT A SILENT EDIT. SAFETY-39
# shipped:
#
# "⚠️ THE SLEW DOES NOT OWN THE OVER-ABSORPTION ... Quartering the slew
# from 1000 to 250 does not reduce the over-absorption at all"
# asserted as _R["slower"]["over"] >= _R["live"]["over"]
#
# and the reasoning under it was right about the mechanism and therefore wrong
# about the conclusion: `slew_w` bounds the OUTPUT while the integrator
# accumulates `gain * error` and is bounded only by `integrator_max_w`, so
# slowing the slew leaves the integrator winding for LONGER and the
# over-absorption got WORSE. Measured on this model at release/1.0
# (`68c5ede`), worst case over the same 51-step family:
#
# slew_w 1000 over-absorbed 1005 W
# slew_w 0 (rail, 556) 1109 W <- SLOWER IS WORSE
# slew_w 400 1285 W
# slew_w 250 1330 W
#
# SAFETY-48 bounds the integrator's LEAD at one slew step, which is exactly the
# quantity that sentence describes. The same six runs on this branch:
#
# slew_w 1000 over-absorbed 729 W
# slew_w 0 (rail, 556) 550 W <- AND NOW SLOWER IS BETTER
# slew_w 400 424 W
# slew_w 250 326 W
#
# So the claim is inverted rather than weakened, on a plant model this file
# writes itself and SAFETY-48's 15.7-day replay of the live install's recorded
# disturbances has never seen. The two agree on the sign, which is worth more
# than either alone. ⚠️ The old direction is asserted as a NEGATIVE below so
# that a revert of SAFETY-48 cannot quietly restore it and leave this section
# green on the other law.
#
# `gain` is still the next constant to re-derive, and SAFETY-48 CHANGED NOTHING
# ABOUT IT: it is a live control-law constant on a running house, and two of
# them moving in one release makes the next measurement uninterpretable.
check("⭐ SAFETY-48: WITH THE INTEGRATOR'S LEAD BOUNDED, A SLOWER SLEW REDUCES "
"THE OVER-ABSORPTION - 1000 -> rail -> 400 -> 250 falls monotonically, "
f"{_R['live']['over']:.0f} -> {_R['rail']['over']:.0f} -> "
f"{_R['interim']['over']:.0f} -> {_R['slower']['over']:.0f} W. On "
"release/1.0 the same four runs RISE: 1005 -> 1109 -> 1285 -> 1330 W",
_R["rail"]["over"] < _R["live"]["over"]
and _R["interim"]["over"] < _R["rail"]["over"]
and _R["slower"]["over"] < _R["interim"]["over"])
check("...and every member of the family over-absorbs LESS than release/1.0's "
"own figure for that member - the recorded four are 1005, 1109, 1285 and "
"1330 W, taken on 68c5ede by running this file",
_R["live"]["over"] < 1005.0 and _R["rail"]["over"] < 1109.0
and _R["interim"]["over"] < 1285.0 and _R["slower"]["over"] < 1330.0)
check("...while the GAIN does own it: 0.6 -> 0.3 -> 0.2 falls monotonically, at "
"the same slew. That is the measurement behind 'gain is the next constant "
"to re-derive', and it is a measurement rather than an opinion",