diff --git a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md index 6afdce2..7f4d923 100644 --- a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md +++ b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md @@ -14,22 +14,24 @@ battery gave what it was told, and the cap held. **Decision.** After a hand-back, the loop's integrator bound is not counted until the plant's settle has passed (`SHORT_CYCLES` cycles and `SHORT_SPAN_S`, the window SAFETY-85 grades a battery on). After that it -counts as before. An over-rating (`clamped`, a bug) always counts. No command -changes, and no text was added or changed. +counts as before. An over-rating (`clamped`, a bug) on a cycle the loop +decided always counts. No command changes, and no text was added or changed. **Kept.** The loop in charge at its rail warns on the same cycle as before. -A loop still at its rail after a hand-back warns once the window has passed: -22 s at a 2 s meter, 55 s at 5 s. Delay, not loss. The start and a restart -after a stop are not hand-backs. +A loop still at its rail after a hand-back warns 11 cycles later (at least +22 s): 22 s at a 2 s meter, 55 s at 5 s, 11 min at a 60 s cycle. The start +and a restart after a stop are not hand-backs. **Re-pinned.** test_safety84 (all six) and test_safety87 (`n1_crossing`, `n1_above`, `n1_charge_low`): only OUTPUT_CLAMP log rows differ; commands and claims are the same (`test_safety119.py` part 5). -**Open.** If another owner and the loop swapped the wire every few cycles, -each swap restarts the window and the loop's bound would not be counted. -A loop at its rail beats a floor or ceiling on its own side, so it keeps the -wire; a swap needs a claim that keeps outranking it. +**Open.** Each hand-back restarts the window, so a loop that loses the wire +again within 11 cycles is never counted. Seen in review: N=2 (2 x 2500 W), a +5 s meter, a cheap-window charge with no usable forecast, a house 50-100 W +over the 5000 W rating. The guard and the charge took the wire back at least +every 11 cycles. 0 notifications in 2 h, 28 without this rule. The cap held. +From 200 W over the rating it warns about once a quarter. **Not changed.** The kick itself is control behaviour: for a few seconds at a quarter's edge the loop asks up to its rail. In `test_safety119.py` part 1