MAINT-20 part 2 r2: cut the comments that came in with SMA-2, SMA-10, SAFETY-128 and SAFETY-137
Word for word in MAIN-orchestration-archive.md, keyed by the line at 16029d7.
No code change.
Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
glenn schrooyen
co-authored by
Claude
Claude
parent
c2b4302dcf
commit
8fc5f15b03
@@ -2583,3 +2583,182 @@ everything an operator needs, and a stack trace on top of it would say
|
||||
"this crashed" - the exact confusion AC3 is about. 78 is sysexits(3)
|
||||
EX_CONFIG, so even a script reading the exit status can tell a bad
|
||||
config from a bug.
|
||||
|
||||
## Added at release/1.0 `16029d7` (SMA-2, SMA-10, SAFETY-128, SAFETY-137)
|
||||
|
||||
Same form, keyed by the first line number in `app/main.py` at `16029d7`.
|
||||
|
||||
### L143 SMA-10. The same bound for handing a unit back (`driver.release()`). I
|
||||
|
||||
SMA-10. The same bound for handing a unit back (`driver.release()`). It is the
|
||||
time the shutdown path already allows one 0 W write, and the units are
|
||||
released CONCURRENTLY, so one slow or hung unit costs the wind-down no more
|
||||
than a hung GoodWe write does today: the Supervisor's kill window is not lost
|
||||
to it. A release still running at the bound is abandoned, not awaited.
|
||||
|
||||
### L150 SMA-10 round 2. The one fallback write after a failed release (default
|
||||
|
||||
SMA-10 round 2. The one fallback write after a failed release (default 0 W,
|
||||
`Driver.release_fallback()`). Worst case for a unit whose release hangs:
|
||||
RELEASE_BUDGET_S + FALLBACK_BUDGET_S = 6 s, against the Supervisor's 10 s.
|
||||
|
||||
### L156 SAFETY-137. How long a LAST write (the Stop 0 W, the shutdown 0 W, a r
|
||||
|
||||
SAFETY-137. How long a LAST write (the Stop 0 W, the shutdown 0 W, a release)
|
||||
waits for a write already on its way to the same unit. Half the release
|
||||
budget, as `_release_last` always waited. For a GoodWe unit that is
|
||||
SETTLE_BUDGET_S + WRITE_BUDGET_S = 6 s at worst, which is HAND_BACK_WORST_S:
|
||||
the wind-down is no slower than SMA-10's worst case.
|
||||
|
||||
### L586 SMA-10. Which units hand back decides what the page says about Stop,
|
||||
|
||||
SMA-10. Which units hand back decides what the page says about Stop,
|
||||
restart and shadow mode. A GoodWe-only roster adds nothing.
|
||||
|
||||
### L3152 SAFETY-128: update the answer gate; seconds the late verdict has
|
||||
|
||||
SAFETY-128: update the answer gate; seconds the late verdict has
|
||||
stood, or None. Readings found late are logged once per episode.
|
||||
DECISIONS/SAFETY-128-late-readings.md.
|
||||
|
||||
### L3805 `inv`'s driver, wired to this Controller's Home Assistant on first use
|
||||
|
||||
`inv`'s driver, wired to this Controller's Home Assistant on first use.
|
||||
|
||||
SMA-2. Bound HERE rather than when the roster is built, so a unit added
|
||||
to `self.inverters` afterwards is wired too, and the driver follows
|
||||
whatever `self.hass` is at the time (a check may swap it).
|
||||
|
||||
### L3835 SMA-2. The driver reads, in the order this method always did: SoC,
|
||||
|
||||
SMA-2. The driver reads, in the order this method always did: SoC,
|
||||
then power. `extra` is whatever else the driver learned; nothing
|
||||
consumes it yet.
|
||||
|
||||
### L4074 Wait, at most `budget_s`, for the writes already on their way to
|
||||
|
||||
Wait, at most `budget_s`, for the writes already on their way to
|
||||
`inv` (SAFETY-137: every driver, GoodWe too). A write still running at
|
||||
the bound is left alone, not cancelled: its own WRITE_BUDGET_S ends it.
|
||||
|
||||
### L4082 `release()`, after a write already on its way to `inv` has finished
|
||||
|
||||
`release()`, after a write already on its way to `inv` has finished
|
||||
(at most half the budget is spent waiting for it), so the release is the
|
||||
LAST thing the unit hears and a late write cannot undo it.
|
||||
|
||||
### L4089 SMA-10. Give ONE unit back: exactly one `release()`, then nothing.
|
||||
|
||||
SMA-10. Give ONE unit back: exactly one `release()`, then nothing.
|
||||
|
||||
True when the unit is handed back (now, or already). Never raises: a
|
||||
driver that raises or hangs is logged and the unit is tried again on the
|
||||
next idle write, and it cannot stop a sibling being released or zeroed.
|
||||
|
||||
⚠️ `released` IS SET BEFORE THE FIRST AWAIT. A second caller (the
|
||||
heartbeat while the Stop button is mid-release) then sees it and does
|
||||
nothing, so a unit gets one `release()` and not two. If the release
|
||||
did not take, the flag goes back down and the unit stays un-handed
|
||||
until a later idle write tries again.
|
||||
|
||||
⚠️ IT IS NOT A WRITE: no `note_write`, no `last_write`, so a hand-back
|
||||
cannot be read as a link that answered. `last_write` is cleared so the
|
||||
first write after control starts again is always sent.
|
||||
|
||||
### L4109 After a failure the next try waits one heartbeat, so a hung release
|
||||
|
||||
After a failure the next try waits one heartbeat, so a hung release
|
||||
costs a cycle its 4 s once per heartbeat, not on every cycle. The
|
||||
Stop button and shutdown (`force`) always try.
|
||||
|
||||
### L4146 ⚠️ ONCE. The unit must not keep carrying its last command, but a
|
||||
|
||||
⚠️ ONCE. The unit must not keep carrying its last command, but a
|
||||
0 W re-sent on every try would reset the inverter's own fallback
|
||||
timer for ever. The driver says what the one write is.
|
||||
|
||||
### L4162 --- SMA-10: A UNIT THAT HANDS BACK IS NOT WRITTEN WHILE THE ADD-ON IS
|
||||
|
||||
--- SMA-10: A UNIT THAT HANDS BACK IS NOT WRITTEN WHILE THE ADD-ON IS
|
||||
IDLE. Idle is: shutting down, control stopped, or shadow mode. The
|
||||
unit is released once and then nothing is written to it - not the
|
||||
heartbeat, not the cycle's "stopped" 0 W - so its own controller keeps
|
||||
it. This is the passive half; `command_site_release()` is the active
|
||||
one, for the moment the add-on goes away.
|
||||
|
||||
⚠️ A SAFETY STOP IS NOT IDLE. It happens while control runs (`auto`,
|
||||
not shadow), so it falls through to the 0 W write below: the add-on's
|
||||
own decision to hold 0 W is never turned into a hand-back.
|
||||
|
||||
⚠️ AND CONTROL STARTING AGAIN RE-ARMS THE UNIT: the flag drops and
|
||||
`last_write` is cleared, so the first write goes out whatever it is.
|
||||
`stopping` never re-arms: a shutdown in progress stays handed back.
|
||||
|
||||
### L4181 Control has the unit again: forget the hand-back, and any
|
||||
|
||||
Control has the unit again: forget the hand-back, and any
|
||||
failed streak with it, so the next Stop starts clean (its own
|
||||
one 0 W, its own error line and event).
|
||||
|
||||
### L4302 --- SAFETY-137: THE 0 W THAT ENDS THINGS IS THE LAST WRITE THE UNIT
|
||||
|
||||
--- SAFETY-137: THE 0 W THAT ENDS THINGS IS THE LAST WRITE THE UNIT
|
||||
HEARS. `last` is the Stop 0 W and the shutdown 0 W (and nothing else).
|
||||
It first waits, bounded, for a write already on its way to this unit,
|
||||
so that write cannot land after it. And once shutdown has begun every
|
||||
other write (cycle, heartbeat, a safety stop) is dropped here: the
|
||||
check sits right before the write is created with no await between,
|
||||
so a write that starts after it cannot exist, and one that started
|
||||
before is in `inflight` for the wait above. The idle gate for a
|
||||
hand-back unit is higher up and does the same for those.
|
||||
|
||||
### L4328 SMA-10 / SAFETY-137: kept for every driver, so a release or a last
|
||||
|
||||
SMA-10 / SAFETY-137: kept for every driver, so a release or a last
|
||||
0 W can wait for it (`_await_inflight`).
|
||||
|
||||
### L6948 Signal, then return WITHOUT entering the loop. amain() wakes
|
||||
|
||||
Signal, then return WITHOUT entering the loop. amain() wakes
|
||||
on this, runs the normal wind-down (which commands 0 W, or hands
|
||||
back a unit whose driver does: SMA-10) and re-raises
|
||||
ConfigRefused afterwards, so the exit code is 78 and the
|
||||
inverter is left at zero rather than latched.
|
||||
|
||||
### L7222 SMA-10. The add-on is going away (Stop, shutdown, restart, task
|
||||
|
||||
SMA-10. The add-on is going away (Stop, shutdown, restart, task
|
||||
death, a config refusal): every unit that hands back is given back, and
|
||||
every other unit is held at 0 W exactly as `command_site_zero()` does.
|
||||
|
||||
⚠️ THE SAFETY STOPS AND REFUSALS DO NOT COME HERE. A sign trip, a
|
||||
refused write, a missing reading, another writer: those are the add-on's
|
||||
own decisions and hold 0 W through `write(0)` for EVERY unit, handed-back
|
||||
drivers included. `command_site_zero()` is that, and it is unchanged. A
|
||||
unit the add-on has just declared it cannot trust must not be handed to
|
||||
something else that will then do what it likes with the battery.
|
||||
|
||||
⚠️ A ROSTER WITH NO HAND-BACK UNIT IS `command_site_zero()`, line for
|
||||
line: GoodWe's release is its 0 W write, so Stop keeps today's write
|
||||
and today's heartbeat.
|
||||
|
||||
⚠️ ONE UNIT'S FAILURE IS ITS OWN. `_hand_back()` never raises and is
|
||||
bounded by RELEASE_BUDGET_S; the units run concurrently, so the whole
|
||||
call takes no longer than its slowest bound.
|
||||
|
||||
### L8207 SMA-10: the Stop button is the add-on going quiet, so a unit
|
||||
|
||||
SMA-10: the Stop button is the add-on going quiet, so a unit
|
||||
that hands back is given back; every other unit is zeroed.
|
||||
|
||||
### L8254 SMA-10. `await awaitable`, but give up after `budget_s` and do NOT wai
|
||||
|
||||
SMA-10. `await awaitable`, but give up after `budget_s` and do NOT wait
|
||||
for it to wind down. `asyncio.wait_for` waits for the cancelled task to
|
||||
finish, so a driver that ignores its cancellation would hold the whole
|
||||
shutdown; this abandons it. Raises `asyncio.TimeoutError` at the bound.
|
||||
|
||||
### L8434 SMA-2. The flat options are the one-inverter shape, so it is the
|
||||
|
||||
SMA-2. The flat options are the one-inverter shape, so it is the
|
||||
GoodWe driver's, asked without a Controller (none exists yet).
|
||||
|
||||
Reference in New Issue
Block a user