admin/goodwe-addon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SAFETY-121: a recurring overload warns every quarter
checks / unit (pull_request) Successful in 44m51s
Details
infra-pin / fresh (pull_request) Successful in 1s
Details

Browse Source 
TEST-23 F-1: on a 5 s meter a steady overload warned once in 70 min. The
loop was at its bound 4-5 cycles a quarter, all inside SAFETY-119's settle
of 12 cycles (60 s) and under its budget of 8 per 900 s. The simulation
fed the meter a cycle behind the battery reading, so the guard and the
charge chased each other and gave ~20 bound cycles a quarter.

The settle is now 4 cycles and 22 s (HANDBACK_CYCLES, SHORT_SPAN_S), and
the rolling budget one number, 11 per 900 s, at every cycle length. The
cycle length is no longer tracked. Commands unchanged; the re-pinned
digests of test_safety84/87 differ from bee7431 in OUTPUT_CLAMP rows only.
test_safety119 runs the rig's shape (meter in the same cycle) at 1-15 s
and checks a stop keeps the budget (review F2, X3).

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
glenn schrooyen
2026-10-21 10:09:14 +02:00
co-authored by Claude
parent bee7431793
commit 8bf25696cb
6 changed files with 291 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md
+4 -1
View File
@@ -1,6 +1,9 @@
# SAFETY-119 - no "not keeping up" when the loop takes the wire back
**Status: for review.** Tests: `test_safety119.py`.
**Status: merged (bee7431); the settle and the budget changed in SAFETY-121**
(DECISIONS/SAFETY-121-bound-every-quarter.md: 4 cycles and 22 s, one budget
of 11). The rolling-budget sections below describe bee7431. Tests:
`test_safety119.py`.
**Cause.** When another owner (the peak guard, a maintenance charge) has set
the wire and the loop wins again, `cycle()` re-seeds the integrator from that
goodwe_controller/DECISIONS/SAFETY-121-bound-every-quarter.md
+91
View File
@@ -0,0 +1,91 @@
# SAFETY-121 - a recurring overload warns every quarter
**Status: for review.** Tests: `test_safety119.py` (parts 2, 4, 5, 6).
Follows DECISIONS/SAFETY-119-bound-after-hand-back.md.
**The defect (TEST-23, SAFETY-119 rig test F-1).** 5 s meter, 2 x 2500 W,
cap 5000 W, maintenance charge, no forecast, house 5100 W. bee7431 warned
once in 70 min (04:31:01), then not at 04:45, 05:00 or 05:15. Base 75f0804
warned at every quarter start. The loop held the wire once a quarter, at its
start, and was at its bound on 4 or 5 cycles. SAFETY-119's settle (12
cycles, 60 s at 5 s) covered all of them, and 5 cycles a quarter fit in its
budget of 8 per 900 s.
**Why the simulation said "every quarter".** `test_safety119.py` fed the
meter one cycle behind the battery reading (`delay` counts cycles: 5 s at a
5 s meter). Just after the loop leaves its rail, the guard's charge
headroom (house = meter + battery) is then off by up to 5000 W, the charge
pulls 2000 W, the guard steps in again, and the two chase each other: 8 to
10 hand-backs and about 20 bound cycles a quarter at 5 s (rig: 1 and 4-5).
With the meter read in the same cycle (`delay` 0, the rig's shape) the sim
gives the rig's numbers: 3 to 5 bound cycles a quarter at 5 s, all inside
SAFETY-119's settle, and bee7431 warns in 0 to 2 of 7 quarters. The test
now runs both shapes.
**Decision.** After a hand-back the loop's bound is hidden until 4 cycles
(`HANDBACK_CYCLES`) and 22 s (`SHORT_SPAN_S`) have passed; across all
hand-backs on at most 11 cycles (`ROLLING_BOUND_CYCLES`) in any 900 s. The
budget no longer follows the cycle length, and the cycle length is not
tracked. A stop ends the settle and keeps the budget. An over-rating always
counts. Commands are unchanged.
**Why it holds for any number of bound cycles a quarter.** The settle is
fixed: at most 3 cycles or 22 s after a hand-back, whichever is longer. A
bound that lasts past it counts on its first cycle after it. So one
hand-back a quarter, with the loop at its rail past the settle, warns in
that quarter, whether it is 1 bound cycle or 100. A bound that never lasts
past a settle counts once more than 11 are hidden within 900 s. Hidden
are only shapes with at most 11 bound cycles in 900 s, each within 3 cycles
or 22 s of a hand-back. That is the quarter-edge kick: in every steady-meter
run below it is on the 1st to 3rd cycle after its hand-back (up to 30 s at
a 30 s meter). In the rig's shape at 5 s the bound comes 30 to 55 s after
the hand-back.
**Sweep** (`goodwe-addon-checks:1`, 2 h runs, scratch/SAFETY-121/dev/).
Quarter edge = test_safety119 part 1 (house 800 W, cap 2500 W, no
forecast). Overload = part 4 (2 x 2500 W, cap 5000 W, house 5050 or
5100 W, seeds 0-3). "Delay 1" is the old sim, "delay 0" the rig's shape.
| meter | quarter edge, runs with a warning (new / bee7431 / no fix) | overload delay 1, quarters warned of 7 (new / bee7431 / no fix) | overload delay 0, 5100 W (new / bee7431 / no fix) |
|---|---|---|---|
| 1 s | 0/70 / 0/70 / 68/70 | 7 / 7 / 7 | 7 / 7 / 7 |
| 2 s | 0/70 / 0/70 / 39/70 | 7 / 7 / 7 | 7 / 7 / 7 |
| 3 s | 0/70 / 0/70 / 40/70 | 7 / 7 / 7 | 7 / 7 / 7 (5050 W: 7 / 1-7 / 7) |
| 5 s | 0/70 / 0/70 / 40/70 | 7 / 7 / 7 | 7 / 0-2 / 7 |
| 10 s | 0/70 / 0/70 / 40/70 | 7 / 7 / 7 | 7 / 0 / 7 |
| 15 s | 0/70 / 0/70 / 40/70 | 7 / 4-7 / 7 | no fix warns 0-1 (5300 W: 7 / 0 / 7) |
| 20 s | 0/60 / 0/60 / 30/60 | 7 / 5-7 / 7 | no fix warns 0 (5300 W: 7 / 0 / 7) |
| 30 s | 0/60 / 0/60 / 30/60 | 7 / 3-5 / 7 | no fix warns 0 (5300 W: 6-7 / 0 / 6-7) |
Quarter-edge seeds: 1-30 with the meter in the same cycle, and 1-40 (1-30
at 20 and 30 s) with the test's 1-2 cycle delay. 5300 W: seeds 1-5.
Commands identical to no fix and to bee7431 in all 1013 runs (these and
the limits below). Choosing the numbers: the runs above were recorded
without the fix and replayed through candidate rules; with 3, 4 or 5
cycles, budgets 9 to 13 met both cases at 1-30 s. 8 warns at the quarter
edge (2 s, seed 25) and 14 misses quarters in the rig's shape (1 s,
5050 W), both checked in part 4. 11 is the middle, and 4 the middle of 3
to 5; with a jittery meter (below) 3 gave more false alarms, 5 more quiet
quarters (replay).
**First warning after one hand-back** (the loop at its rail; later than
no fix by): 11 s at 1 s, 22 s at 2 s, 24 s at 3 s, 25 s at 5 s (default),
30 s at 10 s, 45 s at 15 s, 60 s at 20 s, 90 s at 30 s, 180 s at 60 s.
bee7431: 10, 20, 30, 40, 80, 90, 80, 120, 240 s. In the overload runs at
1 to 30 s, the first warning was at most 90 s later than without the fix.
**Limits (measured, not fixed).**
- A meter that jitters by 30 % with `cycle_floor_s` 15 (11 seeds): with
the test's 1-2 cycle meter delay the quarter edge warns on 2 of 11 seeds
at 15 s, 2 at 20 s and 5 at 30 s (bee7431: 4, 0, 10; no fix: 11 each);
with the meter in the same cycle on none (no fix: 10, 9, 11). The overload at 5100 W leaves up
to 4 quiet quarters in a row at 15 and 20 s (bee7431: no warning at all
on some seeds); at 5200 W at most 1.
- With cycles over about 40 s, a bound that is never past a settle cannot
use up 11 in 900 s, so it is never counted (part 5 prints it at 60 s).
- Hidden as designed: a real bound with the kick's shape (at most 11 cycles
in 900 s, each within 3 cycles or 22 s of a hand-back).
**Re-pinned.** test_safety84 (all six) and test_safety87 (`n1_crossing`,
`n1_above`, `n1_charge_low`): only OUTPUT_CLAMP log rows differ from
bee7431 and from no fix; commands, claims, guard and phases are the same.
goodwe_controller/app/main.py
+17 -27
View File
@@ -299,14 +299,14 @@ REFUSED_PROGRESS_W = _ctl.PROBE_ANSWER_W / 2
# was told over the same span as above (the plant's measured settle time), so
# a healthy battery still settling on a new command is not short.
SHORT_CYCLES, SHORT_SPAN_S = _ctl.SETTLE_CYCLES, REFUSED_SPAN_S
# SAFETY-119: across all hand-backs, the loop's bound is hidden on at most
# ROLLING_BUDGET cycles in any ROLLING_S seconds, fewer on a slower cycle:
# (cycle seconds up to, cycles), measured in
# DECISIONS/SAFETY-119-bound-after-hand-back.md. Without a monotonic clock
# the budget never refills.
# SAFETY-119/121: after a hand-back the loop's bound is hidden until
# HANDBACK_CYCLES cycles and SHORT_SPAN_S have passed; across all hand-backs
# on at most ROLLING_BOUND_CYCLES cycles in any ROLLING_S seconds. Measured in
# DECISIONS/SAFETY-121-bound-every-quarter.md. Without a monotonic clock the
# budget never refills.
HANDBACK_CYCLES = 4
ROLLING_S = 900.0
ROLLING_BUDGET = ((3.5, 10), (11.0, 8), (16.0, 6), (float("inf"), 4))
ROLLING_BOUND_CYCLES = 8 # the budget while the cycle length is unknown
ROLLING_BOUND_CYCLES = 11
def _refused_interval(sign: int) -> tuple:
@@ -1282,12 +1282,11 @@ class Controller:
self._short_run = 0
# SAFETY-119: did another owner set the wire last cycle; the window
# after a hand-back (monotonic s, the loop's cycles in a row); the
# monotonic s of the bound cycles hidden in the last ROLLING_S; the
# last cycle's monotonic s and the cycle length.
# monotonic s of the bound cycles hidden in the last ROLLING_S (a
# stop does not clear them).
self._wire_lost = False
self._handback = None
self._hidden = ()
self._settle_t, self._settle_dt = None, None
self.stopping = False
# SAFETY-61. time.monotonic() at the end of the last run_control() pass.
self.loop_pass_mono = None
@@ -5830,7 +5829,6 @@ class Controller:
self._short_run = 0
self._asked_hist = {}
self._wire_lost, self._handback = False, None
self._settle_t = None # a stop is not a cycle length
return
unmet = self.allocation.unmet_w if self.allocation is not None else 0
cut = (resolution.bound_by or "").split("(")[0]
@@ -5871,20 +5869,15 @@ class Controller:
"""SAFETY-119: does the loop's bound on this cycle count? Not within
a settle after another owner handed the wire back: its integrator is
re-seeded from that owner's command and kicked by a meter that does
not show it yet. The settle is SHORT_CYCLES cycles and SHORT_SPAN_S
after the hand-back; losing the wire restarts it. Across all
hand-backs the bound is hidden on at most ROLLING_BUDGET[cycle
length] cycles in any ROLLING_S, so a bound that stays is counted
however often the wire changes hands.
DECISIONS/SAFETY-119-bound-after-hand-back.md."""
not show it yet. SAFETY-121: the settle is HANDBACK_CYCLES cycles and
SHORT_SPAN_S after the hand-back, so a bound that outlasts it counts
at any cycle length; losing the wire restarts it. Across all
hand-backs the bound is hidden on at most ROLLING_BOUND_CYCLES cycles
in any ROLLING_S, so a bound that never outlasts a settle is counted
too. DECISIONS/SAFETY-121-bound-every-quarter.md."""
def aged(t0, span):
return now is None or t0 is None or now - t0 >= span
# The cycle length (a gap over two minutes is not one).
if now is not None and self._settle_t is not None \
and 0.0 < now - self._settle_t <= 120.0:
self._settle_dt = now - self._settle_t
self._settle_t = now
if not owns:
self._wire_lost, self._handback = True, None
return False
@@ -5895,16 +5888,13 @@ class Controller:
tc, n = self._handback
n += 1
self._handback = (tc, n)
if aged(tc, SHORT_SPAN_S) and n >= SHORT_CYCLES:
if aged(tc, SHORT_SPAN_S) and n >= HANDBACK_CYCLES:
self._handback = None
return False
if self.loop_clamped[0] and not self.loop_clamped[2]:
kept = tuple(t for t in self._hidden if now is None or (
t is not None and now - t < ROLLING_S))
dt = self._settle_dt
budget = ROLLING_BOUND_CYCLES if dt is None else next(
m for up, m in ROLLING_BUDGET if dt <= up)
if len(kept) >= budget:
if len(kept) >= ROLLING_BOUND_CYCLES:
self._hidden = kept
return False
self._hidden = kept + (now,)
goodwe_controller/test_safety119.py
+164 -94
View File
@@ -9,11 +9,12 @@ It crossed its rail for one or two cycles, the loop's ask beat the one-sided
limit, so the cycle counted as the loop's own and raised
`goodwe_integrator_bound`. The battery gave what it was told. Now the loop's
bound does not count until the plant's settle (SHORT_CYCLES cycles and
SHORT_SPAN_S) has passed since the hand-back. Round 3: across all
hand-backs the bound is hidden on at most ROLLING_BUDGET[cycle length] cycles
(10 up to a 3.5 s cycle, 8 up to 11 s, 6 up to 16 s, 4 beyond) in any
ROLLING_S seconds, so a bound that stays warns when the guard and the charge
keep taking turns. DECISIONS/SAFETY-119-bound-after-hand-back.md.
SHORT_SPAN_S) has passed since the hand-back. SAFETY-121: the settle is
HANDBACK_CYCLES (4) cycles and SHORT_SPAN_S (22 s), and across all
hand-backs the bound is hidden on at most ROLLING_BOUND_CYCLES (11) cycles in
any ROLLING_S (900 s), at every cycle length.
DECISIONS/SAFETY-119-bound-after-hand-back.md,
DECISIONS/SAFETY-121-bound-every-quarter.md.
1. The rig's shape (1 s meter that lags the battery, 1 s battery lag, house
800 W, rating 2500 W, limit 2500 W, margin 50, charge 2000 W, no
@@ -25,12 +26,15 @@ keep taking turns. DECISIONS/SAFETY-119-bound-after-hand-back.md.
3. With a usable forecast: the same commands and the same alarms as without
the fix.
4. Repeated hand-backs (N=2, the guard and the charge take turns), 2, 5, 10
and 15 s meters: it warns (every quarter at 2, 5 and 10 s, every other
quarter at least at 15 s); the quarter-edge case stays silent at 2, 5, 10
and 15 s, including the 2 s seed where a fixed budget of 8 warns; a start
or a blind cycle is not a hand-back; a slow meter delays by cycles.
5. The rule at its boundaries (`Controller._settling`): the settle, and the
rolling budget.
and 15 s meters: it warns in every quarter, both with the meter a cycle
behind the battery reading and in the rig's shape (SAFETY-121, F-1: the
meter read in the same cycle, 1 to 5 bound cycles a quarter), where
SAFETY-119's settle of 12 cycles hid every quarter but one; the
quarter-edge case stays silent at 2, 5, 10 and 15 s; the budget's margins
(8 warns at the quarter edge, 14 misses quarters); a start or a blind
cycle is not a hand-back; the delay after one hand-back.
5. The rule at its boundaries (`Controller._settling`): the settle, the
rolling budget, and a stop that does not give the budget back.
6. test_safety84's and test_safety87's re-pinned digests: the same commands
and claims; only OUTPUT_CLAMP log rows differ.
@@ -252,7 +256,7 @@ _first = notes(_hb[1])[:1]
print(f" hand-back to a loop at its rail at 600 s: first notification "
f"{_first}, without the fix {notes(_hb_old[1])[:1]}; command at the "
f"end {_hb[0][-1][1]}")
MB = 10 # the budget at a 1 s cycle
MB = 11 # the budget (at 1 s it ends the settle)
check(f"⭐ the loop at its rail after a hand-back still warns, once "
f"{MB} of its bound cycles are hidden (1 s meter: {MB} s)",
_first and 600.0 + MB <= _first[0] <= 600.0 + MB + 4.0
@@ -317,10 +321,18 @@ def round1(self, owns, now):
# over the 5000 W rating from 300 s: the loop never held the wire for more
# than 10 cycles. Round 1: no notification in 2 h; round 2: none at 10 s or
# 15 s meters.
def never(tick, hw=5050.0, fix=True):
def never(tick, hw=5050.0, fix=True, seed=0, delay=1):
"""`seed` 0: a constant house; else 800 W +- 30 W, `hw` +- 30 W from
300 s. `delay` 0 is the rig's shape: the meter read in the same cycle
as the battery (SAFETY-121)."""
rig.TICK = tick
if seed:
load = (lambda t, h=house(seed):
h(t) + (hw - 800.0 if t >= 300.0 else 0.0))
else:
load = house(1, step=(300.0, hw))
try:
f = lambda: run(house(1, step=(300.0, hw)), n=2)
f = lambda: run(load, n=2, delay=delay)
return f() if fix else no_fix(f)
finally:
rig.TICK = 1.0
@@ -331,6 +343,10 @@ def per_quarter(c):
for q in range(8)]
def every_quarter(c):
return all(n >= 1 for n in per_quarter(c)[1:])
_nv = {t: never(t) for t in (2.0, 5.0, 10.0, 15.0)}
_nv_old = {t: never(t, fix=False) for t in (2.0, 5.0, 10.0, 15.0)}
_nv_r1 = patched(Controller, "_settling", round1)(lambda: never(5.0))
@@ -341,16 +357,9 @@ for _t in _nv:
f"{len(notes(_nv_old[_t][1]))}, highest quarter "
f"{max(quarters(_nv[_t][1], _t)):.0f} W")
print(f" round 1's rule at 5 s: {len(notes(_nv_r1[1]))}")
check("⭐ 2 s and 5 s meters: it warns in every quarter after the first",
all(per_quarter(_nv[t][1])[q] >= 1 for q in range(1, 8)
for t in (2.0, 5.0)))
check("⭐ 10 s meter: it warns in every quarter after the first (round 2 "
"gave none)",
all(per_quarter(_nv[10.0][1])[q] >= 1 for q in range(1, 8)))
check("⭐ 15 s meter: it warns at least every other quarter after the first "
"(round 2 gave none)",
not any(a == 0 and b == 0 for a, b in zip(
per_quarter(_nv[15.0][1])[1:], per_quarter(_nv[15.0][1])[2:])))
check("⭐ 2, 5, 10 and 15 s meters: it warns in every quarter after the "
"first (round 2 gave none at 10 and 15 s)",
all(every_quarter(_nv[t][1]) for t in _nv))
check("non-vacuous: round 1's rule (a window per hand-back) never warned "
"here, and the fix still hides some of what was raised without it",
notes(_nv_r1[1]) == [] and all(
@@ -363,15 +372,46 @@ check("...and at 5 s the cap held",
len(quarters(_nv[5.0][1], 5.0)) == 8
and max(quarters(_nv[5.0][1], 5.0)) < 5000.0)
# SAFETY-121, the rig's shape (TEST-23, F-1): the meter is read in the same
# cycle as the battery, so the guard's charge headroom is right after it
# hands back and the guard and the charge do not chase each other. The loop
# then holds the wire once a quarter, at its start, and is at its bound on
# 1 to 5 cycles (5 s), not 20. House 5100 W +- 30 W (5300 W at 15 s, where
# 5100 W is over the rating in one quarter only, without the fix too).
RIG = {1.0: 5100.0, 2.0: 5100.0, 5.0: 5100.0, 10.0: 5100.0, 15.0: 5300.0}
_rg = {t: never(t, hw, seed=1, delay=0) for t, hw in RIG.items()}
_rg_old = {t: never(t, hw, fix=False, seed=1, delay=0)
for t, hw in RIG.items()}
# SAFETY-119 as merged (bee7431) at 5 s: a settle of 12 cycles, budget 8.
_rg_119 = patched(app_main, "HANDBACK_CYCLES", app_main.SHORT_CYCLES)(
lambda: patched(app_main, "ROLLING_BOUND_CYCLES", 8)(
lambda: never(5.0, 5100.0, seed=1, delay=0)))
for _t in _rg:
print(f" rig shape, {_t:.0f} s meter, house {RIG[_t]:.0f} W: per "
f"quarter {per_quarter(_rg[_t][1])}, without the fix "
f"{per_quarter(_rg_old[_t][1])}, highest quarter "
f"{max(quarters(_rg[_t][1], _t)):.0f} W")
print(f" rig shape, 5 s, SAFETY-119's settle and budget: per quarter "
f"{per_quarter(_rg_119[1])}")
check("⭐ the rig's shape at 1, 2, 5, 10 and 15 s meters: it warns in every "
"quarter after the first, as without the fix",
all(every_quarter(_rg[t][1]) and every_quarter(_rg_old[t][1])
for t in _rg))
check("non-vacuous (F-1): with SAFETY-119's settle of 12 cycles and budget "
"of 8, the rig's shape at 5 s warns in at most one quarter",
sum(1 for n in per_quarter(_rg_119[1])[1:] if n) <= 1)
check("...every command the same as without the fix, and the cap held at "
"1 to 10 s",
all(commands(_rg[t][0]) == commands(_rg_old[t][0]) for t in _rg)
and all(max(quarters(_rg[t][1], t)) < 5000.0
for t in (1.0, 2.0, 5.0, 10.0)))
# The quarter-edge case (part 1) at the slower meters: still no warning.
# The meter's own lag limits the cap there, the same with and without the fix.
_qe = {}
# Seeds 1 to 3 are the brief's fixed set; 2 s seed 25 is the one where the
# sweep's fixed budget of 8 warned (DECISIONS), kept here so that stays seen.
for _t in (2.0, 5.0, 10.0, 15.0): # with part 1: 1, 2, 5, 10, 15 s
rig.TICK = _t
for _seed, _dl in ((1, 1), (2, 1), (3, 2)) + (
((25, 2),) if _t == 2.0 else ()):
for _seed, _dl in ((1, 1), (2, 1), (3, 2)):
_qe[_t, _seed] = (run(house(_seed), delay=_dl),
no_fix(lambda: run(house(_seed), delay=_dl)))
rig.TICK = 1.0
@@ -379,8 +419,8 @@ for _t in (2.0, 5.0, 10.0, 15.0): # with part 1: 1, 2, 5, 10, 15 s
f"{[len(notes(r[0][1])) for k, r in _qe.items() if k[0] == _t]} "
f"(without the fix "
f"{[len(notes(r[1][1])) for k, r in _qe.items() if k[0] == _t]})")
check("⭐ the quarter-edge case at 2, 5, 10 and 15 s meters, seeds 1 to 3 "
"and (2 s) 25: no notification",
check("⭐ the quarter-edge case at 2, 5, 10 and 15 s meters, seeds 1 to 3: "
"no notification",
all(notes(r[0][1]) == [] and r[0][1].clamp_wd.bound == 0
for r in _qe.values()))
check("...every command the same as without the fix; without it the false "
@@ -388,20 +428,30 @@ check("...every command the same as without the fix; without it the false "
all(commands(r[0][0]) == commands(r[1][0]) for r in _qe.values())
and all(any(len(notes(_qe[_t, k][1][1])) >= 1 for k in (1, 2, 3))
for _t in (2.0, 5.0, 10.0, 15.0)))
# The budget's margins (DECISIONS/SAFETY-121): 9 to 13 met both cases in the
# sweep. 8 warns at the quarter edge (2 s, seed 25); 14 misses quarters in
# the rig's shape (1 s, house 5050 W, seed 1).
rig.TICK = 2.0
_q25_8 = patched(app_main, "ROLLING_BUDGET", ((math.inf, 8),))(
lambda: run(house(25), delay=2))
_q25 = (run(house(25), delay=2),
patched(app_main, "ROLLING_BOUND_CYCLES", 8)(
lambda: run(house(25), delay=2)))
rig.TICK = 1.0
print(f" 2 s meter, seed 25, a fixed budget of 8: notifications "
f"{notes(_q25_8[1])}")
check("...2 s seed 25 is the sweep's known case: a fixed budget of 8 warns "
"there (why the budget follows the cycle length)",
len(notes(_q25_8[1])) >= 1)
check("the budget is the one the sweep chose. Changing it means re-running "
"the sweep in DECISIONS/SAFETY-119-bound-after-hand-back.md",
app_main.ROLLING_BUDGET == ((3.5, 10), (11.0, 8), (16.0, 6),
(math.inf, 4))
and app_main.ROLLING_BOUND_CYCLES == 8 and app_main.ROLLING_S == 900.0)
_m14 = patched(app_main, "ROLLING_BOUND_CYCLES", 14)(
lambda: never(1.0, 5050.0, seed=1, delay=0))
_m11 = never(1.0, 5050.0, seed=1, delay=0)
print(f" 2 s, quarter edge, seed 25: {notes(_q25[0][1])}, budget 8 "
f"{notes(_q25[1][1])}; rig shape 1 s 5050 W per quarter "
f"{per_quarter(_m11[1])}, budget 14 {per_quarter(_m14[1])}")
check("...the budget's margins: 11 is silent at 2 s seed 25 and warns every "
"quarter in the rig's shape at 1 s and 5050 W; 8 warns there, 14 "
"misses a quarter there",
notes(_q25[0][1]) == [] and len(notes(_q25[1][1])) >= 1
and every_quarter(_m11[1]) and not every_quarter(_m14[1]))
check("the rule is the one the sweep chose. Changing it means re-running "
"the sweep in DECISIONS/SAFETY-121-bound-every-quarter.md",
app_main.HANDBACK_CYCLES == 4 and app_main.ROLLING_BOUND_CYCLES == 11
and app_main.ROLLING_S == 900.0 and app_main.SHORT_SPAN_S == 22.0)
# A start, or a blind cycle, is not a hand-back: the loop at its rail after
# 20 s of not running warns at once (R2: a restart counted as a hand-back).
@@ -415,19 +465,22 @@ check("⭐ a start after a blind spell is not a hand-back: it warns at the "
notes(_bl[1])[:1] and 20.0 <= notes(_bl[1])[0] <= 26.0
and notes(_bl[1]) == notes(_bl_old[1]))
# The budget is cycles, not seconds (R4): at a 5 s meter the loop at its
# rail after a hand-back warns 8 cycles (40 s) later, not 8 s.
MB = 8 # the budget at a 5 s cycle
rig.TICK = 5.0
_sl = run(house(1, step=(600.0, -6000.0)), dur=900.0,
extra={"peak_cap_w": 20000})
rig.TICK = 1.0
_sl1 = [t for t in notes(_sl[1]) if t >= 600.0][:1]
print(f" 5 s meter, hand-back to a loop at its rail at 600 s: first "
f"notification {_sl1}")
check(f"⭐ at a 5 s meter the budget is cycles, not seconds: the first "
f"warning comes {MB} cycles ({MB * 5} s) after the hand-back",
_sl1 and 600.0 + MB * 5.0 <= _sl1[0] <= 600.0 + MB * 5.0 + 10.0)
# One hand-back to a loop at its rail at 600 s: the first warning comes when
# the settle ends, 22 s and 4 cycles after it (SAFETY-119: 12 cycles, 40 s at
# 5 s and 80 s at 10 s).
_sl = {}
for _t in (5.0, 10.0):
rig.TICK = _t
_sl[_t] = run(house(1, step=(600.0, -6000.0)), dur=900.0,
extra={"peak_cap_w": 20000})
rig.TICK = 1.0
_sl1 = {t: [x for x in notes(r[1]) if x >= 600.0][:1] for t, r in _sl.items()}
print(f" hand-back to a loop at its rail at 600 s, first notification: "
f"5 s {_sl1[5.0]}, 10 s {_sl1[10.0]}")
check("⭐ one hand-back (the loop has the wire from the cycle after the "
"step): the first warning comes 25 s after it at a 5 s meter (the "
"22 s span), 30 s after it at 10 s (4 cycles)",
_sl1[5.0] == [630.0] and _sl1[10.0] == [640.0])
# ============================================================================ #
print("\n5. the rule at its boundaries")
@@ -438,7 +491,6 @@ class _C:
def __init__(self):
self._wire_lost, self._handback, self._hidden = False, None, ()
self._settle_t, self._settle_dt = None, None
self.loop_clamped = (False, "", False)
@@ -451,21 +503,30 @@ def seq(c, steps):
return out
N, SPAN = app_main.SHORT_CYCLES, app_main.SHORT_SPAN_S
M, ROLL = 8, 900.0 # the chosen budget, written out on purpose
SPAN = app_main.SHORT_SPAN_S
K, M, ROLL = 4, 11, 900.0 # the chosen rule, written out on purpose
_c = _C()
check("from the start, owned every cycle: never settling (no hand-back)",
seq(_c, [(True, float(i)) for i in range(30)]) == [False] * 30)
_c = _C()
_out = seq(_c, [(False, 0.0)] + [(True, 2.0 * i) for i in range(1, N + 3)])
check(f"after another owner: settling for {N - 1} owned cycles, then not "
f"(12 cycles at 2 s span {SPAN:.0f} s)",
_out == [False] + [True] * (N - 1) + [False] * 3)
_out = seq(_c, [(False, 0.0)] + [(True, 2.0 * i) for i in range(1, 15)])
check(f"after another owner at 2 s: settling for 11 owned cycles, then not "
f"(the span, {SPAN:.0f} s, decides)",
_out == [False] + [True] * 11 + [False] * 3)
_c = _C()
_out = seq(_c, [(False, 0.0)] + [(True, 0.5 * i) for i in range(1, 60)])
_end = _out.index(False, 1) if False in _out[1:] else -1
check(f"at a 0.5 s meter the span decides: settling until {SPAN:.0f} s",
_end == 1 + int(SPAN / 0.5) and all(_out[1:_end]))
_set = {}
for _tick in (10.0, 30.0, 60.0):
_c = _C()
_set[_tick] = seq(_c, [(False, 0.0)]
+ [(True, _tick * i) for i in range(1, K + 2)])
check(f"at 10, 30 and 60 s the cycles decide: settling for {K - 1} owned "
f"cycles, then not (SAFETY-119: 11)",
all(o == [False] + [True] * (K - 1) + [False] * 2
for o in _set.values()))
_c = _C()
_out = seq(_c, [(False, 0.0), (True, 2.0), (True, 4.0), (False, 6.0),
(True, 8.0), (True, 10.0)])
@@ -474,12 +535,19 @@ check("losing the wire again restarts the settle",
and _c._handback == (8.0, 2))
_c = _C()
check("no monotonic clock: the cycle count alone decides",
seq(_c, [(False, None)] + [(True, None)] * (N + 1))
== [False] + [True] * (N - 1) + [False] * 2)
seq(_c, [(False, None)] + [(True, None)] * (K + 1))
== [False] + [True] * (K - 1) + [False] * 2)
# The rolling budget: the loop's bound is hidden on at most M cycles in any
# ROLL seconds, across all hand-backs. T = the loop's bound that cycle.
assert M < N - 1, "the budget is meant to run out inside one settle"
# One hand-back, the loop's bound on every cycle: the settle (5 s) or the
# budget (1 s) ends the hiding.
_c = _C()
_o5 = seq(_c, [(False, 0.0)] + [(True, 5.0 * i, True) for i in range(1, 9)])
_c = _C()
_o1 = seq(_c, [(False, 0.0)] + [(True, 1.0 * i, True) for i in range(1, 21)])
check("one hand-back, the bound on every cycle: 5 hidden at 5 s (22 s), "
f"then counted; {M} hidden at 1 s (the budget), then counted",
_o5 == [False] + [True] * 5 + [False] * 3
and _o1 == [False] + [True] * M + [False] * (20 - M))
def turns(c, tick, lost, periods, first=0.0, bound=True):
@@ -499,11 +567,8 @@ def turns(c, tick, lost, periods, first=0.0, bound=True):
return out, t
_c = _C()
_o = seq(_c, [(False, 0.0)] + [(True, 5.0 * i, True) for i in range(1, N)])
check(f"one hand-back at 5 s, the bound on every cycle: {M} are hidden, "
f"then it counts for the rest of the settle ({N - 1} cycles)",
_o == [False] + [True] * M + [False] * (N - 1 - M))
# The rolling budget: the loop's bound is hidden on at most M cycles in any
# ROLL seconds, across all hand-backs.
_c = _C()
_o, _ = turns(_c, 5.0, 3, 60)
_hid = [t for t, h in _o if h]
@@ -528,7 +593,7 @@ check(f"the budget refills {ROLL:.0f} s after the oldest hidden cycle: "
_a is False and _b is True)
_c = _C()
_o1, _t = turns(_c, 2.0, 3, 20)
for _ in range(N): # the wire away a whole settle
for _ in range(12): # the wire away a whole settle
_c._settling(False, _t)
_t += 2.0
_o2, _ = turns(_c, 2.0, 3, 5, first=_t)
@@ -539,7 +604,7 @@ check("the budget is not per hand-back or per run: after a whole settle "
and not any(h for _t2, h in _o2))
_c = _C()
_o1, _t = turns(_c, 2.0, 3, 20)
_ = [_c._settling(True, _t + 2.0 * i) for i in range(N + 1)]
_ = [_c._settling(True, _t + 2.0 * i) for i in range(13)]
_c._settling(False, _t + 40.0)
_c.loop_clamped = (True, "", False)
check("the loop holding the wire a whole settle ends the window: the next "
@@ -558,24 +623,20 @@ _c.loop_clamped = (True, "", False)
check("an over-rating does not use up the budget",
_c._settling(True, _t + 5.0) is True and len(_c._hidden) == 1)
# The budget follows the cycle length: bound cycles hidden before the first
# one counts, one hand-back per turn.
# The budget is one number at every cycle length (SAFETY-119 scaled it).
_bud = {}
for _tick in (1.0, 2.0, 3.0, 5.0, 10.0, 15.0, 20.0, 30.0, 60.0):
for _tick in (1.0, 2.0, 3.0, 5.0, 10.0, 15.0, 20.0, 30.0):
_c = _C()
_o, _ = turns(_c, _tick, 1, min(14, int(880.0 // (2 * _tick))))
_o, _ = turns(_c, _tick, 1, 14)
_bud[_tick] = sum(1 for _t2, h in _o if h)
print(f" hidden before the first counts, by cycle length: {_bud}")
check("the budget by cycle length: 10 at 1-3 s, 8 at 5-10 s, 6 at 15 s, 4 "
"at 20-60 s",
_bud == {1.0: 10, 2.0: 10, 3.0: 10, 5.0: 8, 10.0: 8, 15.0: 6,
20.0: 4, 30.0: 4, 60.0: 4})
_c = _C()
_o, _t = turns(_c, 2.0, 3, 8)
_o2, _ = turns(_c, 121.0, 1, 3, first=_t + 119.0)
check("a gap over two minutes is not a cycle length: the 2 s budget (10) "
"stays",
[h for _t2, h in _o + _o2] == [True] * 10 + [False])
_o60, _ = turns(_c, 60.0, 1, 14)
print(f" hidden before the first counts, one bound cycle per turn: {_bud}; "
f"at 60 s, turns of 2 cycles: {sum(1 for _t2, h in _o60 if h)} of 14 "
"hidden (the budget never runs out: DECISIONS limit)")
check(f"the budget does not follow the cycle length: {M} hidden at 1 to "
"30 s, then counted",
set(_bud.values()) == {M})
# No monotonic clock: the budget cannot refill, so a bound that stays is
# counted after the budget however often the wire changes hands.
@@ -586,8 +647,8 @@ for _ in range(40):
_c._settling(False, None)
_c.loop_clamped = (True, "", False)
_nc.append(_c._settling(True, None))
check("no monotonic clock, repeated hand-backs: the budget holds (8 hidden, "
"then every bound counts)", _nc == [True] * M + [False] * (40 - M))
check(f"no monotonic clock, repeated hand-backs: the budget holds ({M} "
"hidden, then every bound counts)", _nc == [True] * M + [False] * (40 - M))
# An over-rating (a command over `max_w`) is a bug, never settled away.
_ctl = _hb[1]
@@ -613,13 +674,22 @@ _ctl._loop_alarm_input(_Res())
check("...while the integrator bound on the next cycle is not counted",
_ctl.loop_clamped[0] is False)
# A stop ends the window but does not give the budget back (review F2, X3).
_now = _ctl._now_mono
_ctl._hidden = (_now,) * M
_ctl._wire_lost, _ctl._handback = True, (1.0, 3)
_ctl._loop_decision = None # stopped or blind
_ctl._loop_alarm_input(_Res())
check("a stop clears it: the next start is not a hand-back, and the stop "
"is not a cycle length",
(_ctl._wire_lost, _ctl._handback, _ctl._settle_t)
== (False, None, None))
_st, _kept = (_ctl._wire_lost, _ctl._handback), _ctl._hidden
_ctl._settling(False, _now + 1.0)
_ctl.loop_clamped = (True, "", False)
_after = _ctl._settling(True, _now + 2.0)
check("a stop clears the window (the next start is not a hand-back) and "
f"keeps the budget: with {M} hidden, the bound after the next "
"hand-back counts",
_st == (False, None) and _kept == (_now,) * M and _after is False)
print(f" after the stop: hidden kept {len(_kept)}, the next hand-back's "
f"bound hidden {_after}")
# ============================================================================ #
print("\n6. the pinned digests of test_safety84 and test_safety87: only the "
goodwe_controller/test_safety84.py
+9 -8
View File
@@ -474,20 +474,21 @@ print("\n8. the N=1 and N=2 digests")
# pin lifts (t=1800) and B no longer jumps 1390 W, and after the surplus step.
# SAFETY-119 re-pinned all six: only the log. OUTPUT_CLAMP rows from the
# loop's bound just after the guard hands back are gone; every command and
# claim is the same (test_safety119.py part 6).
# claim is the same (test_safety119.py part 6). SAFETY-121 re-pinned all six
# again: only OUTPUT_CLAMP rows (test_safety119.py part 6).
PINNED = {
"n1_charge":
"19781f90b9751b10994dedeaafb38e42d48ad2551640792e601336b7f9b5bb4f",
"0ed25c856456b97acb07a39299a8cb7b1a762c4d0005b88a0823c03057a80be5",
"n1_charge_dear":
"eeeb0fa19a6fdc04d44a0838bb2bb911f506a936b0f93d8a6f4d87159053ec74",
"c25340b56060d4581f7204e200b07e7c8618711be2baca3b1667b7ebeb600dc3",
"n1_charge_banked":
"a51f125a8c1c98fdbb009fce72b6781d20d384bdf0f5ce7bbfe367d86e5477db",
"2619acdd06b04e56c000b168d64e1d044346c6ba3f929c94258d6ad8189ec609",
"n2_charge":
"e37e98390baa5dad9128991fabf8b170894395fe026d8a33c8a51de7ed0789cc",
"b16d692128f14bcce3d87b142d290e0d6b13724289680e44a05215c9eaa24a7c",
"n2_charge_dear":
"7727372de423f62d77b4426a7226eae31a30f3bb89a3cf70272cc7c1823d7263",
"aa2bbc677a8e2274b25ba1170de1b1635e08a3bd93105e2a38a9bb1575b5b6db",
"n2_charge_banked":
"c77e26006c026b953e9c3dcc9a02f3993589f885cb52c7cbceac6bd59b600551",
"a6973faea916e4c88ca1770047f94478346eeb1efa4889b154fad0747f91267f",
}
_now = s84.digests()
for k in PINNED:
@@ -495,7 +496,7 @@ for k in PINNED:
f"{_now[k][:16]}")
check("⭐ at N=1 a charge in and out of a cheap window and under a banked "
"month peak is byte-identical to 9d5b7d1 (commands, reasons and every "
"claim; the log as re-pinned by SAFETY-119), and N=2 outside a cheap "
"claim; the log as re-pinned by SAFETY-121), and N=2 outside a cheap "
"window matches its SAFETY-85 pin",
all(_now[k] == PINNED[k] for k in ("n1_charge", "n1_charge_dear",
"n1_charge_banked",
goodwe_controller/test_safety87.py
+6 -5
View File
@@ -521,18 +521,19 @@ print("\n9. N=1 is byte-identical to release/1.0 b8ddfd7")
# SAFETY-119 re-pinned n1_crossing, n1_above and n1_charge_low: only the
# log. The loop's bound just after a hand-back is not counted, so OUTPUT_CLAMP
# rows are gone or count fewer; every command and claim is the same
# (test_safety119.py part 6).
# (test_safety119.py part 6). SAFETY-121 re-pinned the same three again:
# only OUTPUT_CLAMP rows (test_safety119.py part 6).
PINNED = { # tools/safety87_identity.py on b8ddfd7
"n1_under":
"d2395ef8d74fb23607ad864d5a4bf62c03044bbd9367e873675d7ad10e8c169f",
"n1_crossing":
"20f8e542c1ee3eb3a58c8fd6ba3b3e5b6b1486800cd63b675abc68bc222a172b",
"97f7321017d9d34ee17a40dfd4abf73d915f25b9faef086a483d2b5cd124b198",
"n1_above":
"3a79f1394b2b49fa88f3c054da1d9da450153ad5f0d2a2c2f960d02a7abe2208",
"9229b0f0e8addd1bd114461cc36c7f02e9734012b3b7e154d7747bd4cc69b773",
"n1_under_banked":
"a2876c7cc873bc4c974d2b4bd98e23bba2d007b84545587d2fe0b713b0a6249b",
"n1_charge_low":
"2e1ee6db0d4f9f18836c4cbbe406fddd496656b54b97f329da513a1591f0ce6c",
"91336e3c0314985a3b00f314c79b5ffb5a740d218de3ad44f88a4db6e4235b32",
"n1_hold":
"0a1df347754c69166b20d04c15ee878bbcefb02abb824b9b452334f68f03e46d",
}
@@ -540,7 +541,7 @@ _now = s87.digests()
for k in PINNED:
print(f" {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'}")
check("⭐ every N=1 digest (claims, commands, the guard's decision and the "
"log) equals b8ddfd7's (the log as re-pinned by SAFETY-119), under, "
"log) equals b8ddfd7's (the log as re-pinned by SAFETY-121), under, "
"crossing and above the reserve, in a charge and a HOLD, and under a "
"banked peak",
_now == PINNED)