SAFETY-81: no false 'Load too high' alarms
checks / unit (pull_request) Successful in 16m11s
infra-pin / fresh (pull_request) Successful in 1s

The alarm now also needs peakguard.load_too_high(): with the battery at
full power, the quarter still ends more than 10 W over the real limit.
The battery reading is the lower of this cycle's and the last, so a meter
sample from before the battery's last increase is not counted twice.
At most one alarm per quarter. Control outputs unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
goodwe-agent
2026-09-29 19:55:38 +02:00
parent 5a4cdc273e
commit 6eb67c0f9c
6 changed files with 433 additions and 7 deletions
@@ -0,0 +1,47 @@
# SAFETY-81 — no false "Load too high for battery" alarms
**Status: 2026-09-29, owner go for the card. The 10 W tolerance is this PR's choice, for review.**
## Defect
The SAFETY-79 test (SAFETY-79-test-report.md, F1/F2) saw 6 false alarms in 7.
The alarm fired whenever `decide()` clamped its floor to the rating
(`saturated`). Three things set that while the quarter landed on target:
- **Double count.** `decide()` sizes from the held meter reading plus the
battery reading. When the meter sample predates the battery's last increase,
the increase is counted twice. It happens under noise, and at each quarter
start, where the battery is back while the held sample is still the spike.
- **The aim, not the cap.** `saturated` is graded against cap − margin, so at
margin 50 noise needs 50 W less to trip it (F2).
- **Last seconds.** The gain 900 / remaining turns a few W over the aim into
thousands of W wanted, with the battery far from its rating.
## Decision
The alarm needs `saturated` and `peakguard.load_too_high()`: with the battery
at full power from now on, the quarter still ends more than `ALARM_MISS_W`
(10 W) over the real limit (`ceiling_w`). That is the miss itself, without the
gain. The battery reading it uses is the lower of this cycle's and the last
one's. At most one alarm per quarter, because near the threshold the test
flickers with the meter.
**Why 10 W:** at margin 0 the guard itself lands up to +5.7 W over (SAFETY-79
test, check 5), and those misses are real but tiny; the alarm would fire in
the last second of most guarded quarters. The margin (default 50) is the fix
for them. Cost: a real miss of 10 W or less is not alarmed.
**Cost:** a load that climbs slowly through the band between the aim and the
cap alarms when the quarter will end over the cap, not at the aim (10 s later
in `ramp6500`). A step overload alarms in the same cycle as before; a real
overload shows on the meter before the battery moves, so the lower reading
costs it nothing. A quarter already over that the battery cannot win back
still alarms (test_peakguard.py's saturated fixture).
## Not changed: the 1 s spike itself
The cycle after a quarter boundary and before the new quarter's first meter
sample still sees 0 s left, files no claim, and an Off battery drops to 0 W for
one cycle. That is the same edge tick as OPT-15 F1, so it is left to OPT-15.
Control is unchanged here: every command in `tools/safety81_sim.py` is
byte-identical to 5a4cdc2 (test_safety81.py part 1).
+7 -4
View File
@@ -1739,7 +1739,8 @@ control action and goes to the action log and the status page. A *saturated*
guard — asking for everything the inverter has while the quarter is still
projected over — raises one notification (`goodwe_peak_saturated`), because that
is the one state where the money will be spent and shedding load is the only
thing left that changes the bill.
thing left that changes the bill. SAFETY-81 keeps a 1 s meter spike, noise and
a quarter's last seconds from raising it: see `peakguard.load_too_high()`.
**And it sizes a price-driven charge, not only a forced discharge (SAFETY-45).**
The same arithmetic read the other way answers *"how hard may this site charge
@@ -3211,9 +3212,11 @@ reason code `OUTPUT_CLAMP`.
**Load too high for battery.** The capacity-peak guard (SAFETY-07) asks for
everything the inverter can discharge and the running 15-minute average is
still projected over the peak limit, so the month's billed peak
(capaciteitstarief) goes up. In shadow mode the guard's projection is made on a
plant that did not respond (SAFETY-47), and the text says so. See *The
capacity-peak guard*.
(capaciteitstarief) goes up. It fires only when, with the battery at full
power, the period will still end more than 10 W over the real limit (not the
margin's aim), and at most once per period (SAFETY-81). In shadow mode the
guard's projection is made on a plant that did not respond (SAFETY-47), and
the text says so. See *The capacity-peak guard*.
**Battery stopped limiting the peak.** The peak guard may not discharge below
`peak_soc_floor` (label “Peak reserve”, SAFETY-24). It also stops when the
+28 -3
View File
@@ -922,6 +922,10 @@ class Controller:
"peak_margin_w", peakguard.PEAK_OPTION_DEFAULTS["peak_margin_w"]))
self._peak_engaged = False
self._peak_saturated = False
# SAFETY-81: what the alarm is graded on, beside the guard's decision.
self._peak_proj = None
self._peak_batt_prev = None
self._peak_alarm_block = None
self._peak_floor_limited = False
self._maint_shape_suspended = False
# OPT-11. Battery modes, off by default so an install that has not
@@ -3712,8 +3716,10 @@ class Controller:
# is not measured on that path, and the honest report is NOT COVERED -
# the same answer, for the same reason, that the status page already
# gives for SAFETY-18 on a transport that cannot see `unchanged_s`.
self._peak_proj = (None if not self.p1_enabled
else self.peak.project(self.p1.averager, now))
self.peak_guard = None if not self.p1_enabled else peakguard.decide(
self.peak.project(self.p1.averager, now),
self._peak_proj,
# ⚠️ THE SITE SUM. The guard sizes a floor from what the battery is
# ALREADY removing from the meter, and the meter sees every
# inverter. One unit's power here would size the floor from a
@@ -4816,15 +4822,34 @@ class Controller:
available to it. That is the one state where the money is going to be
spent and a human is the only remaining actuator.
SAFETY-81: `g.saturated` alone is not enough. It is graded against the
aim, and a 1 s meter spike, noise or the last seconds of a quarter set
it while the quarter lands on target; `peakguard.load_too_high()` must
agree too. The battery reading it gets is the lower of this cycle's and
the last one's - see there.
Edge-triggered, and de-asserting arms it again - the same shape as
FreezeWatchdog's `evaluate()`, and for the same reason: one notification
per episode, not one per cycle.
per episode, not one per cycle. SAFETY-81: and at most one per quarter.
"""
g = self.peak_guard
saturated = bool(g is not None and g.saturated)
batt, prev = self.site_batt_w, self._peak_batt_prev
self._peak_batt_prev = batt
if batt is not None and prev is not None:
batt = min(float(batt), float(prev))
saturated = bool(
g is not None and g.saturated and self._peak_proj is not None
and peakguard.load_too_high(
self._peak_proj, batt_w=batt, ceiling_w=g.ceiling_w,
achievable_w=self.site_rating_w))
was, self._peak_saturated = self._peak_saturated, saturated
if not saturated or was:
return
# SAFETY-81: at most once per quarter. Near its threshold the test
# above flickers with the meter, and each flicker would re-alarm.
if self._peak_proj.block_start == self._peak_alarm_block:
return
self._peak_alarm_block = self._peak_proj.block_start
self.log_event("PEAK_GUARD_SATURATED - " + g.reason,
hint=messages.hint("peak_saturated"))
_LOG.error(
+31
View File
@@ -866,6 +866,37 @@ def decide(projection, *, batt_w, cap_w, margin_w, reading, achievable_w, soc,
if saturated else "")))
# SAFETY-81. A quarter must end this many W over the real limit before
# "Load too high for battery" fires. Above the guard's own landing error at
# margin 0 (up to +5.7 W, SAFETY-79 test check 5), which margin 0 accepts.
ALARM_MISS_W = 10.0
def load_too_high(projection, *, batt_w, ceiling_w, achievable_w) -> bool:
"""SAFETY-81. May "Load too high for battery" fire? Only if, with the
battery at full power from now on, the quarter still ends more than
`ALARM_MISS_W` over the real limit (`ceiling_w`, not the aim).
This is the miss itself, in W of the quarter average, so it does not have
`decide()`'s gain (900 / remaining): near a quarter's end that gain turns
a watt over the aim into thousands of W wanted.
The load is the held meter reading plus `batt_w`. The caller passes the
lower of this cycle's and the last cycle's battery reading, so a meter
sample taken before the battery's last increase is not counted twice
(DECISIONS/SAFETY-81-load-too-high.md). A real overload shows on the meter
before the battery moves, so that filter costs it no cycle.
"""
remaining = QUARTER_S - float(projection.elapsed_s)
if batt_w is None or remaining <= 0.0:
return False
rest = float(projection.held_w) + float(batt_w) - float(achievable_w)
done_ws = (QUARTER_S * float(projection.projected_w)
- max(float(projection.held_w), 0.0) * remaining)
ends_w = (done_ws + max(rest, 0.0) * remaining) / QUARTER_S
return ends_w - float(ceiling_w) > ALARM_MISS_W
def charge_headroom_w(decision) -> float | None:
"""SAFETY-45. The hardest this SITE may charge without putting the billed
quarter over the ceiling, in W, positive - or None when nothing measured it.
+117
View File
@@ -0,0 +1,117 @@
"""Runnable check for SAFETY-81, no false "Load too high for battery" alarms.
`python3 test_safety81.py`
Drives the REAL Controller through tools/safety81_sim.py (a 1 s cycle on a
plant shaped like the SAFETY-79 rig, one sample in ten late).
DECISIONS/SAFETY-81-load-too-high.md has the record.
1. Every command is byte-identical to release/1.0 5a4cdc2.
2. No alarm on the quarter-edge spike, the last seconds, noise (margin 50
and 0) or a burst the quarter absorbs.
3. Real overloads still alarm, as fast as on 5a4cdc2.
4. peakguard.load_too_high() on its own.
Mutations (MUTATION.md, purged copies) are listed in the pull request.
"""
import os
import sys
from types import SimpleNamespace
HERE = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, os.path.join(HERE, "tools"))
import safety81_sim as sim # noqa: E402
from app.peakguard import load_too_high # noqa: E402
fails = []
def check(name, cond):
print(f" {'ok ' if cond else 'FAIL'} {name}")
if not cond:
fails.append(name)
# Printed by `python3 tools/safety81_sim.py` on release/1.0 5a4cdc2 (the tool
# copied in, nothing else changed), in the CI image: (alarm times, digest).
BASE = {
"const4500": ([2699.0], "6ba6b8634f0df9526adc04f03c82db7d083973268deda0d1f07c5519bc2e5e9d"),
"const4500_m0": ([2699.0], "2bede28f3ea6ba9294be134c9b9733e43d22a7c24deac3bf8210bbbbe09b2039"),
"sine4500": ([2699.0], "bf70c2c23a0eede40c34478d1354b7daa1858e0a0f920693e2dd15fb5046120f"),
"edge4600": ([2.0, 902.0, 1802.0, 2699.0], "3cc0c6fec0c70f138530955babc2b416fe7307373037c1b2e927b6ccdaad3a4d"),
"edge4600_m0": ([2.0, 902.0, 1802.0, 2699.0], "ba9ba2c042ee42b043315b996ece38b3478dc9866aaf833256c9c29c02f0fe9f"),
"burst_end": ([881.0, 1781.0, 2681.0], "5f70e1eb4244820f1d44b494cb80e51f1a4486dee03357c9a8e8f7d371c5d9af"),
"noise5000_m50": ([292.0, 2551.0, 2698.0], "48b446e1a78e6d6032b31cb68a4eadb0f74e3aec4cc1e184162e9c65449bfdc5"),
"noise5000_m0": ([292.0, 2552.0, 2698.0], "1a0527dee6c2b03dc95a90b4682858c7bf5edf7205c2aced249112f04328c960"),
"step6500": ([1201.0, 1801.0], "95e5c90e4a6814526cb4f3bea76286063b449d86a420f888c014531fb6e913a3"),
"miss5560": ([1201.0, 1801.0], "cd991cfe1685750598236701a5a2f2f0342d66645609c536d42ab7ba07216e6c"),
"ramp6500": ([1296.0, 1801.0], "8db7675535f1a01abf38bd6bfb996a6fe57711d3ecca53541bb1c0870748c46b"),
"step7500_reserve": ([], "21eb9c07a4582f47f347084d1c75a28a5d767bc068bc3f74f32433d3239e9ccb"),
}
RUN = {k: sim.run(**v)[:2] for k, v in sim.SCENARIOS.items()}
# ============================================================================ #
print("1. every command byte-identical to release/1.0 5a4cdc2")
check("the same scenarios as 5a4cdc2", set(RUN) == set(BASE))
for k, (alarms, digest) in RUN.items():
check(f"{k}: digest {digest[:12]}", digest == BASE[k][1])
# ============================================================================ #
print("2. no false alarm (5a4cdc2's are listed)")
for k in ("edge4600", "edge4600_m0", "const4500", "const4500_m0", "sine4500",
"noise5000_m50", "noise5000_m0", "burst_end"):
check(f"{k}: none (5a4cdc2: {BASE[k][0]})", RUN[k][0] == [])
# ============================================================================ #
print("3. real overloads still alarm, as fast as 5a4cdc2")
for k in ("step6500", "miss5560"):
print(f" {k}: load steps up at 1200 s; alarms at {RUN[k][0]}, "
f"5a4cdc2 {BASE[k][0]}")
check(f"{k}: the same second as 5a4cdc2, and again only at the next "
f"quarter (at most once per quarter)", RUN[k][0] == BASE[k][0])
# By design: until 1306 s this quarter would end at most ALARM_MISS_W over the
# real 3500 W cap; 5a4cdc2 alarmed when it crossed the aim (cap - 50).
print(f" ramp6500: alarms at {RUN['ramp6500'][0]}, "
f"5a4cdc2 {BASE['ramp6500'][0]}")
check("ramp6500: alarms once the quarter will end over the real cap by "
"more than ALARM_MISS_W",
RUN["ramp6500"][0] == [1306.0, 1801.0])
check("step7500 under the peak reserve: not this alarm (the guard is not "
"allowed to discharge)", RUN["step7500_reserve"][0] == [])
# ============================================================================ #
print("4. load_too_high()")
def proj(elapsed, done_avg, held):
"""A projection `elapsed` s in, averaging `done_avg` so far."""
r = 900.0 - elapsed
return SimpleNamespace(elapsed_s=elapsed, held_w=held,
projected_w=(done_avg * elapsed + max(held, 0) * r)
/ 900.0)
def ltl(p, batt, cap=3500.0, rail=2000.0):
return load_too_high(p, batt_w=batt, ceiling_w=cap, achievable_w=rail)
check("load 6000 W vs 3500 + 2000: yes", ltl(proj(300, 3450, 4000), 2000))
check("already over, the battery can carry the load but not catch up: yes",
ltl(proj(450, 7200, 7200), 0, rail=5000))
check("the last second, a 7 W miss (under ALARM_MISS_W): no",
not ltl(proj(899, 3509, 2500), 1000))
check("a miss of exactly ALARM_MISS_W: no",
not ltl(proj(450, 3520, 3500), 2000))
check("...and 1 W more: yes", ltl(proj(450, 3522, 3500), 2000))
check("over cap + battery, but the quarter lands under the cap: no",
not ltl(proj(880, 3450, 4000), 2000))
check("...and when it does not: yes", ltl(proj(700, 3450, 4000), 2000))
check("no battery reading: no", not ltl(proj(300, 3450, 5000), None))
check("no seconds left: no", not ltl(proj(900, 4000, 5000), 2000))
print()
if fails:
print(f"FAILED: {len(fails)} check(s)")
sys.exit(1)
print("all checks passed")
+203
View File
@@ -0,0 +1,203 @@
#!/usr/bin/env python3
"""SAFETY-81: when does "Load too high for battery" fire?
python3 tools/safety81_sim.py # alarms and a control digest per run
The REAL Controller (read_inputs + cycle) at a 1 s cycle, on a plant shaped
like the SAFETY-79 test rig: one battery switched Off (so only the peak guard
makes it give, max 2000 W), a 3500 W cap, and a P1 meter that publishes
0.3 s before each cycle. The battery reaches a new command 0.5 s after it is
written. One meter sample in ten arrives late (the add-on still holds the one
before), so the held meter reading can predate the battery's last change:
the double count behind the rig's false alarms. The cycle on a quarter
boundary, before the new quarter's first sample, files no peak claim, which
is the rig's 1 s grid spike at each quarter change. Each run returns the
alarm times and a digest of every command, so the same runs show both what
changed and what did not.
"""
import asyncio
import hashlib
import os
import random
import sys
import tempfile
import time
from datetime import timedelta
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
import opt11_identity as rig # noqa: E402
import app.main as m # noqa: E402
from app import packmode # noqa: E402
from app.main import Controller # noqa: E402
from app.p1 import make_sample, split_signed # noqa: E402
from app.store import unit_key # noqa: E402
TICK = 1.0
SAMPLE_LEAD_S = 0.3 # the meter publishes this long before each cycle
RESPONSE_S = 0.5 # a new command reaches the battery this much later
LATE_P = 0.1 # share of meter samples that arrive late
ALARM = "goodwe_peak_saturated"
def constant(w):
return lambda t: w
def noisy(mean, amp, seed=81):
"""`mean` +/- `amp`, a new uniform value every second."""
rnd = random.Random(seed)
table = {}
def f(t):
k = int(t)
if k not in table:
table[k] = mean + rnd.uniform(-amp, amp)
return table[k]
return f
def sine(mean, amp, period=120.0, noise=50.0):
import math
n = noisy(0.0, noise, seed=79)
return lambda t: mean + amp * math.sin(2 * math.pi * t / period) + n(t)
def step(before, after, at):
return lambda t: before if t < at else after
def ramp(before, after, at, secs):
return lambda t: before + (after - before) * min(max(t - at, 0.0) / secs, 1.0)
class _Plant:
"""One battery that reaches its command RESPONSE_S after the write."""
def __init__(self, load, rating, soc):
self.load, self.rating, self.soc = load, rating, soc
self.t = 0.0
self.hist = [(-1e9, 0.0)] # (time the command takes effect, W)
self.notes = []
self.meter = 0.0 # the last meter reading delivered
def batt(self, at):
w = 0.0
for when, v in self.hist:
if when <= at:
w = v
return max(-self.rating, min(self.rating, float(round(w))))
def grid(self, at):
return self.load(at) - self.batt(at)
async def limits(self, e):
return (-5000.0, 5000.0, 1.0)
async def call(self, domain, service, data):
if service == "create":
self.notes.append((self.t, data.get("notification_id")))
return True
async def number(self, e, invert=False):
if e in ("sensor.grid", "sensor.net"):
return self.meter
if e.startswith("sensor.soc"):
return self.soc
if e.startswith("sensor.batt"):
return self.batt(self.t)
return None
async def set_number(self, e, v):
self.hist.append((self.t + RESPONSE_S, float(v)))
return True
def run(load, *, margin=50, dur=2700.0, rating=2000.0, cap=3500.0,
late_at=(), soc=60.0):
"""Alarm times (s from the start of the first quarter) and a digest of
every cycle's target and written command. A sample is also late at each
`t % 900` in `late_at`."""
opts = rig._options(1, {
"meter_source": "ha_signed", "p1_net_entity": "sensor.net",
"meter_phases": 1, "peak_cap_w": cap, "peak_margin_w": margin,
"battery_modes_enabled": True, "max_w": rating})
store = rig._Store()
store.data[unit_key("inverter-a", packmode.USE_KEY)] = False
store.data[packmode.USE_KEY] = False
db = os.path.join(tempfile.mkdtemp(prefix="s81-"), "tariff.db")
async def go():
plant = _Plant(load, rating, soc)
c = Controller(opts, plant, store, rig._Pub(), stop=asyncio.Event(),
peak_db_path=db)
for i in c.inverters:
i.dev_min, i.dev_max = -5000.0, 5000.0
c.auto = True
real_dt, clock = m.datetime, [0.0]
class _DT(real_dt):
@classmethod
def now(cls, tz=None):
return rig.BASE + timedelta(seconds=clock[0])
m.datetime = _DT
rows, late = [], random.Random(8100)
try:
t = 0.0
while t < dur:
plant.t = clock[0] = t
ts = t - SAMPLE_LEAD_S
if late.random() >= LATE_P and t % 900 not in late_at:
plant.meter = plant.grid(ts)
imp, exp = split_signed(plant.meter)
c.p1.submit(make_sample(
"ha_signed", imp, exp, phases=1,
ingest_ts=rig.BASE + timedelta(seconds=ts),
ingest_mono=time.monotonic()))
await c.read_inputs(now_mono=t)
await c.cycle()
rows.append((t, c.target, round(plant.hist[-1][1], 6)))
t += TICK
finally:
m.datetime = real_dt
return plant, c, rows
plant, c, rows = asyncio.run(go())
alarms = [t for t, nid in plant.notes if nid == ALARM]
return alarms, hashlib.sha256(repr(rows).encode()).hexdigest(), c, rows
# Three quarters each (2700 s); a new quarter starts at 900 s and 1800 s.
SCENARIOS = {
# F1: constant and sine loads the battery carries, across quarter edges.
"const4500": dict(load=constant(4500.0)),
"const4500_m0": dict(load=constant(4500.0), margin=0),
"sine4500": dict(load=sine(4500.0, 400.0)),
# F1 at the start of a quarter: the sample after the battery's return
# is late, so the held reading is the 1 s spike (the battery at 0 W).
"edge4600": dict(load=constant(4600.0), late_at=(2.0,)),
"edge4600_m0": dict(load=constant(4600.0), margin=0, late_at=(2.0,)),
# 6000 W in a quarter's last 20 s: over cap + battery, but the quarter
# still lands between the aim and the cap.
"burst_end": dict(load=lambda t: 6000.0 if t % 900 >= 880 else 4500.0),
# F2: a noisy load the battery carries, at margin 50 and 0.
"noise5000_m50": dict(load=noisy(5000.0, 150.0)),
"noise5000_m0": dict(load=noisy(5000.0, 150.0), margin=0),
# Real: from 1200 s the house needs 1000 W more than cap + battery.
"step6500": dict(load=step(4500.0, 6500.0, 1200.0)),
# Real, small: from 1200 s, 60 W (+/- 20 W noise) more than cap + battery.
"miss5560": dict(load=lambda t: step(4500.0, 5560.0, 1200.0)(t)
+ noisy(0.0, 20.0)(t)),
# Real, slow: 4500 -> 6500 W over 200 s from 1200 s, through the band
# between the aim (cap - 50) and the real cap.
"ramp6500": dict(load=ramp(4500.0, 6500.0, 1200.0, 200.0)),
# The pack under its peak reserve (20 %), and a load far over cap +
# battery: that is "Battery stopped limiting the peak", not this alarm.
"step7500_reserve": dict(load=step(4500.0, 7500.0, 1200.0), soc=15.0),
}
if __name__ == "__main__":
for k, v in SCENARIOS.items():
a, d, _, _ = run(**v)
print(f"{k:16s} alarms at {a} digest {d}")