From 98026f9a464217dfab994988f06d99a7ffe14f7e Mon Sep 17 00:00:00 2001 From: glenn schrooyen Date: Mon, 19 Oct 2026 20:17:08 +0200 Subject: [PATCH] SAFETY-119 review: DECISIONS states the worst delay and the no-warn case The delay is 11 cycles, so up to 11 min at a 60 s cycle. A loop that loses the wire again within 11 cycles is never counted; review measured one such case (N=2, cheap-window charge, no forecast, house just over the rating). The over-rating rule applies on cycles the loop decided. Text only. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC --- .../SAFETY-119-bound-after-hand-back.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md index 6afdce2..7f4d923 100644 --- a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md +++ b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md @@ -14,22 +14,24 @@ battery gave what it was told, and the cap held. **Decision.** After a hand-back, the loop's integrator bound is not counted until the plant's settle has passed (`SHORT_CYCLES` cycles and `SHORT_SPAN_S`, the window SAFETY-85 grades a battery on). After that it -counts as before. An over-rating (`clamped`, a bug) always counts. No command -changes, and no text was added or changed. +counts as before. An over-rating (`clamped`, a bug) on a cycle the loop +decided always counts. No command changes, and no text was added or changed. **Kept.** The loop in charge at its rail warns on the same cycle as before. -A loop still at its rail after a hand-back warns once the window has passed: -22 s at a 2 s meter, 55 s at 5 s. Delay, not loss. The start and a restart -after a stop are not hand-backs. +A loop still at its rail after a hand-back warns 11 cycles later (at least +22 s): 22 s at a 2 s meter, 55 s at 5 s, 11 min at a 60 s cycle. The start +and a restart after a stop are not hand-backs. **Re-pinned.** test_safety84 (all six) and test_safety87 (`n1_crossing`, `n1_above`, `n1_charge_low`): only OUTPUT_CLAMP log rows differ; commands and claims are the same (`test_safety119.py` part 5). -**Open.** If another owner and the loop swapped the wire every few cycles, -each swap restarts the window and the loop's bound would not be counted. -A loop at its rail beats a floor or ceiling on its own side, so it keeps the -wire; a swap needs a claim that keeps outranking it. +**Open.** Each hand-back restarts the window, so a loop that loses the wire +again within 11 cycles is never counted. Seen in review: N=2 (2 x 2500 W), a +5 s meter, a cheap-window charge with no usable forecast, a house 50-100 W +over the 5000 W rating. The guard and the charge took the wire back at least +every 11 cycles. 0 notifications in 2 h, 28 without this rule. The cap held. +From 200 W over the rating it warns about once a quarter. **Not changed.** The kick itself is control behaviour: for a few seconds at a quarter's edge the loop asks up to its rail. In `test_safety119.py` part 1