diff --git a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md index bb05e7e..6c7256b 100644 --- a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md +++ b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md @@ -1,6 +1,9 @@ # SAFETY-119 - no "not keeping up" when the loop takes the wire back -**Status: for review.** Tests: `test_safety119.py`. +**Status: merged (bee7431); the settle and the budget changed in SAFETY-121** +(DECISIONS/SAFETY-121-bound-every-quarter.md: 4 cycles and 22 s, one budget +of 11). The rolling-budget sections below describe bee7431. Tests: +`test_safety119.py`. **Cause.** When another owner (the peak guard, a maintenance charge) has set the wire and the loop wins again, `cycle()` re-seeds the integrator from that diff --git a/goodwe_controller/DECISIONS/SAFETY-121-bound-every-quarter.md b/goodwe_controller/DECISIONS/SAFETY-121-bound-every-quarter.md new file mode 100644 index 0000000..b15b374 --- /dev/null +++ b/goodwe_controller/DECISIONS/SAFETY-121-bound-every-quarter.md @@ -0,0 +1,95 @@ +# SAFETY-121 - a recurring overload warns every quarter + +**Status: for review.** Tests: `test_safety119.py` (parts 2, 4, 5, 6). +Follows DECISIONS/SAFETY-119-bound-after-hand-back.md. + +**The defect (TEST-23, SAFETY-119 rig test F-1).** 5 s meter, 2 x 2500 W, +cap 5000 W, maintenance charge, no forecast, house 5100 W. bee7431 warned +once in 70 min (04:31:01), then not at 04:45, 05:00 or 05:15. Base 75f0804 +warned at every quarter start. The loop held the wire once a quarter, at its +start, and was at its bound on 4 or 5 cycles. SAFETY-119's settle (12 +cycles, 60 s at 5 s) covered all of them, and 5 cycles a quarter fit in its +budget of 8 per 900 s. + +**Why the simulation said "every quarter".** `test_safety119.py` fed the +meter one cycle behind the battery reading (`delay` counts cycles: 5 s at a +5 s meter). Just after the loop leaves its rail, the guard's charge +headroom (house = meter + battery) is then off by up to 5000 W, the charge +pulls 2000 W, the guard steps in again, and the two chase each other: 8 to +10 hand-backs and about 20 bound cycles a quarter at 5 s (rig: 1 and 4-5). +With the meter read in the same cycle (`delay` 0, the rig's shape) the sim +gives the rig's numbers: 3 to 5 bound cycles a quarter at 5 s, all inside +SAFETY-119's settle, and bee7431 warns in 0 to 2 of 7 quarters. The test +now runs both shapes. + +**Decision.** After a hand-back the loop's bound is hidden until 4 cycles +(`HANDBACK_CYCLES`) and 22 s (`SHORT_SPAN_S`) have passed; across all +hand-backs on at most 11 cycles (`ROLLING_BOUND_CYCLES`) in any 900 s. The +budget no longer follows the cycle length, and the cycle length is not +tracked. A stop ends the settle and keeps the budget. An over-rating always +counts. Commands are unchanged. + +**Why it holds for any number of bound cycles a quarter.** The settle is +fixed: at most 3 cycles or 22 s after a hand-back, whichever is longer. A +bound that lasts past it counts on its first cycle after it. So one +hand-back a quarter, with the loop at its rail past the settle, warns in +that quarter, whether it is 1 bound cycle or 100. A bound that never lasts +past a settle counts once more than 11 are hidden within 900 s. Hidden +are only shapes with at most 11 bound cycles in 900 s, each within 3 cycles +or 22 s of a hand-back. That is the quarter-edge kick: in every steady-meter +run below it is on the 1st to 3rd cycle after its hand-back (up to 30 s at +a 30 s meter). In the rig's shape at 5 s the bound comes 30 to 55 s after +the hand-back. + +**Sweep** (`goodwe-addon-checks:1`, 2 h runs, scratch/SAFETY-121/dev/). +Quarter edge = test_safety119 part 1 (house 800 W, cap 2500 W, no +forecast). Overload = part 4 (2 x 2500 W, cap 5000 W, house 5050 or +5100 W, seeds 0-3). "Delay 1" is the old sim, "delay 0" the rig's shape. + +| meter | quarter edge, runs with a warning (new / bee7431 / no fix) | overload delay 1, quarters warned of 7 (new / bee7431 / no fix) | overload delay 0, 5100 W (new / bee7431 / no fix) | +|---|---|---|---| +| 1 s | 0/70 / 0/70 / 68/70 | 7 / 7 / 7 | 7 / 7 / 7 | +| 2 s | 0/70 / 0/70 / 39/70 | 7 / 7 / 7 | 7 / 7 / 7 | +| 3 s | 0/70 / 0/70 / 40/70 | 7 / 7 / 7 | 7 / 7 / 7 (5050 W: 7 / 1-7 / 7) | +| 5 s | 0/70 / 0/70 / 40/70 | 7 / 7 / 7 | 7 / 0-2 / 7 | +| 10 s | 0/70 / 0/70 / 40/70 | 7 / 7 / 7 | 7 / 0 / 7 | +| 15 s | 0/70 / 0/70 / 40/70 | 7 / 4-7 / 7 | no fix warns 0-1 (5300 W: 7 / 0 / 7) | +| 20 s | 0/60 / 0/60 / 30/60 | 7 / 5-7 / 7 | no fix warns 0 (5300 W: 7 / 0 / 7) | +| 30 s | 0/60 / 0/60 / 30/60 | 7 / 3-5 / 7 | no fix warns 0 (5300 W: 6-7 / 0 / 6-7) | + +Quarter-edge seeds: 1-30 with the meter in the same cycle, and 1-40 (1-30 +at 20 and 30 s) with the test's 1-2 cycle delay. 5300 W: seeds 1-5. +Commands identical to no fix and to bee7431 in all 1013 runs (these and +the limits below). Choosing the numbers: the runs above were recorded +without the fix and replayed through candidate rules; with 3, 4 or 5 +cycles, budgets 9 to 13 met both cases at 1-30 s. 8 warns at the quarter +edge (2 s, seed 25) and 14 misses quarters in the rig's shape (1 s, +5050 W), both checked in part 4. 11 is the middle, and 4 the middle of 3 +to 5; with a jittery meter (below) 3 gave more false alarms, 5 more quiet +quarters (replay). + +**First warning after one hand-back** (the loop at its rail; later than +no fix by): 11 s at 1 s, 22 s at 2 s, 24 s at 3 s, 25 s at 5 s (default), +30 s at 10 s, 45 s at 15 s, 60 s at 20 s, 90 s at 30 s, 180 s at 60 s. +bee7431: 10, 20, 30, 40, 80, 90, 80, 120, 240 s. In the overload runs at +1 to 30 s, the first warning was at most 90 s later than without the fix. + +**Limits (measured, not fixed).** +- A meter that jitters by 30 % with `cycle_floor_s` 15 (11 seeds): with + the test's 1-2 cycle meter delay the quarter edge warns on 2 of 11 seeds + at 15 s, 2 at 20 s and 5 at 30 s (bee7431: 4, 0, 10; no fix: 11 each); + with the meter in the same cycle on none (no fix: 10, 9, 11). The overload at 5100 W leaves up + to 4 quiet quarters in a row at 15 and 20 s (bee7431: no warning at all + on some seeds); at 5200 W at most 1. Its first warning came up to 61 min + later than without the fix. The numbers depend on the jitter draw: the + review's draw gave 4, 4 and 5 of 11 at the quarter edge (bee7431: 4, 1, + 9) and up to 2 and 4 quiet quarters at 15 and 20 s. +- With cycles over about 40 s, a bound that is never past a settle uses up + 11 in 900 s only if the wire changes hands every few cycles; otherwise + it is never counted (part 5 prints it at 60 s). +- Hidden as designed: a real bound with the kick's shape (at most 11 cycles + in 900 s, each within 3 cycles or 22 s of a hand-back). + +**Re-pinned.** test_safety84 (all six) and test_safety87 (`n1_crossing`, +`n1_above`, `n1_charge_low`): only OUTPUT_CLAMP log rows differ from +bee7431 and from no fix; commands, claims, guard and phases are the same. diff --git a/goodwe_controller/app/main.py b/goodwe_controller/app/main.py index 24aec7f..1a301a0 100644 --- a/goodwe_controller/app/main.py +++ b/goodwe_controller/app/main.py @@ -299,14 +299,14 @@ REFUSED_PROGRESS_W = _ctl.PROBE_ANSWER_W / 2 # was told over the same span as above (the plant's measured settle time), so # a healthy battery still settling on a new command is not short. SHORT_CYCLES, SHORT_SPAN_S = _ctl.SETTLE_CYCLES, REFUSED_SPAN_S -# SAFETY-119: across all hand-backs, the loop's bound is hidden on at most -# ROLLING_BUDGET cycles in any ROLLING_S seconds, fewer on a slower cycle: -# (cycle seconds up to, cycles), measured in -# DECISIONS/SAFETY-119-bound-after-hand-back.md. Without a monotonic clock -# the budget never refills. +# SAFETY-119/121: after a hand-back the loop's bound is hidden until +# HANDBACK_CYCLES cycles and SHORT_SPAN_S have passed; across all hand-backs +# on at most ROLLING_BOUND_CYCLES cycles in any ROLLING_S seconds. Measured in +# DECISIONS/SAFETY-121-bound-every-quarter.md. Without a monotonic clock the +# budget never refills. +HANDBACK_CYCLES = 4 ROLLING_S = 900.0 -ROLLING_BUDGET = ((3.5, 10), (11.0, 8), (16.0, 6), (float("inf"), 4)) -ROLLING_BOUND_CYCLES = 8 # the budget while the cycle length is unknown +ROLLING_BOUND_CYCLES = 11 def _refused_interval(sign: int) -> tuple: @@ -1282,12 +1282,11 @@ class Controller: self._short_run = 0 # SAFETY-119: did another owner set the wire last cycle; the window # after a hand-back (monotonic s, the loop's cycles in a row); the - # monotonic s of the bound cycles hidden in the last ROLLING_S; the - # last cycle's monotonic s and the cycle length. + # monotonic s of the bound cycles hidden in the last ROLLING_S (a + # stop does not clear them). self._wire_lost = False self._handback = None self._hidden = () - self._settle_t, self._settle_dt = None, None self.stopping = False # SAFETY-61. time.monotonic() at the end of the last run_control() pass. self.loop_pass_mono = None @@ -5830,7 +5829,6 @@ class Controller: self._short_run = 0 self._asked_hist = {} self._wire_lost, self._handback = False, None - self._settle_t = None # a stop is not a cycle length return unmet = self.allocation.unmet_w if self.allocation is not None else 0 cut = (resolution.bound_by or "").split("(")[0] @@ -5871,20 +5869,15 @@ class Controller: """SAFETY-119: does the loop's bound on this cycle count? Not within a settle after another owner handed the wire back: its integrator is re-seeded from that owner's command and kicked by a meter that does - not show it yet. The settle is SHORT_CYCLES cycles and SHORT_SPAN_S - after the hand-back; losing the wire restarts it. Across all - hand-backs the bound is hidden on at most ROLLING_BUDGET[cycle - length] cycles in any ROLLING_S, so a bound that stays is counted - however often the wire changes hands. - DECISIONS/SAFETY-119-bound-after-hand-back.md.""" + not show it yet. SAFETY-121: the settle is HANDBACK_CYCLES cycles and + SHORT_SPAN_S after the hand-back, so a bound that outlasts it counts + at any cycle length; losing the wire restarts it. Across all + hand-backs the bound is hidden on at most ROLLING_BOUND_CYCLES cycles + in any ROLLING_S, so a bound that never outlasts a settle is counted + too. DECISIONS/SAFETY-121-bound-every-quarter.md.""" def aged(t0, span): return now is None or t0 is None or now - t0 >= span - # The cycle length (a gap over two minutes is not one). - if now is not None and self._settle_t is not None \ - and 0.0 < now - self._settle_t <= 120.0: - self._settle_dt = now - self._settle_t - self._settle_t = now if not owns: self._wire_lost, self._handback = True, None return False @@ -5895,16 +5888,13 @@ class Controller: tc, n = self._handback n += 1 self._handback = (tc, n) - if aged(tc, SHORT_SPAN_S) and n >= SHORT_CYCLES: + if aged(tc, SHORT_SPAN_S) and n >= HANDBACK_CYCLES: self._handback = None return False if self.loop_clamped[0] and not self.loop_clamped[2]: kept = tuple(t for t in self._hidden if now is None or ( t is not None and now - t < ROLLING_S)) - dt = self._settle_dt - budget = ROLLING_BOUND_CYCLES if dt is None else next( - m for up, m in ROLLING_BUDGET if dt <= up) - if len(kept) >= budget: + if len(kept) >= ROLLING_BOUND_CYCLES: self._hidden = kept return False self._hidden = kept + (now,) diff --git a/goodwe_controller/test_safety119.py b/goodwe_controller/test_safety119.py index 706f08d..e902977 100644 --- a/goodwe_controller/test_safety119.py +++ b/goodwe_controller/test_safety119.py @@ -9,11 +9,12 @@ It crossed its rail for one or two cycles, the loop's ask beat the one-sided limit, so the cycle counted as the loop's own and raised `goodwe_integrator_bound`. The battery gave what it was told. Now the loop's bound does not count until the plant's settle (SHORT_CYCLES cycles and -SHORT_SPAN_S) has passed since the hand-back. Round 3: across all -hand-backs the bound is hidden on at most ROLLING_BUDGET[cycle length] cycles -(10 up to a 3.5 s cycle, 8 up to 11 s, 6 up to 16 s, 4 beyond) in any -ROLLING_S seconds, so a bound that stays warns when the guard and the charge -keep taking turns. DECISIONS/SAFETY-119-bound-after-hand-back.md. +SHORT_SPAN_S) has passed since the hand-back. SAFETY-121: the settle is +HANDBACK_CYCLES (4) cycles and SHORT_SPAN_S (22 s), and across all +hand-backs the bound is hidden on at most ROLLING_BOUND_CYCLES (11) cycles in +any ROLLING_S (900 s), at every cycle length. +DECISIONS/SAFETY-119-bound-after-hand-back.md, +DECISIONS/SAFETY-121-bound-every-quarter.md. 1. The rig's shape (1 s meter that lags the battery, 1 s battery lag, house 800 W, rating 2500 W, limit 2500 W, margin 50, charge 2000 W, no @@ -25,12 +26,15 @@ keep taking turns. DECISIONS/SAFETY-119-bound-after-hand-back.md. 3. With a usable forecast: the same commands and the same alarms as without the fix. 4. Repeated hand-backs (N=2, the guard and the charge take turns), 2, 5, 10 - and 15 s meters: it warns (every quarter at 2, 5 and 10 s, every other - quarter at least at 15 s); the quarter-edge case stays silent at 2, 5, 10 - and 15 s, including the 2 s seed where a fixed budget of 8 warns; a start - or a blind cycle is not a hand-back; a slow meter delays by cycles. -5. The rule at its boundaries (`Controller._settling`): the settle, and the - rolling budget. + and 15 s meters: it warns in every quarter, both with the meter a cycle + behind the battery reading and in the rig's shape (SAFETY-121, F-1: the + meter read in the same cycle, 1 to 5 bound cycles a quarter), where + SAFETY-119's settle of 12 cycles hid every quarter but one; the + quarter-edge case stays silent at 2, 5, 10 and 15 s; the budget's margins + (8 warns at the quarter edge, 14 misses quarters); a start or a blind + cycle is not a hand-back; the delay after one hand-back. +5. The rule at its boundaries (`Controller._settling`): the settle, the + rolling budget, and a stop that does not give the budget back. 6. test_safety84's and test_safety87's re-pinned digests: the same commands and claims; only OUTPUT_CLAMP log rows differ. @@ -252,7 +256,7 @@ _first = notes(_hb[1])[:1] print(f" hand-back to a loop at its rail at 600 s: first notification " f"{_first}, without the fix {notes(_hb_old[1])[:1]}; command at the " f"end {_hb[0][-1][1]}") -MB = 10 # the budget at a 1 s cycle +MB = 11 # the budget (at 1 s it ends the settle) check(f"⭐ the loop at its rail after a hand-back still warns, once " f"{MB} of its bound cycles are hidden (1 s meter: {MB} s)", _first and 600.0 + MB <= _first[0] <= 600.0 + MB + 4.0 @@ -317,10 +321,18 @@ def round1(self, owns, now): # over the 5000 W rating from 300 s: the loop never held the wire for more # than 10 cycles. Round 1: no notification in 2 h; round 2: none at 10 s or # 15 s meters. -def never(tick, hw=5050.0, fix=True): +def never(tick, hw=5050.0, fix=True, seed=0, delay=1): + """`seed` 0: a constant house; else 800 W +- 30 W, `hw` +- 30 W from + 300 s. `delay` 0 is the rig's shape: the meter read in the same cycle + as the battery (SAFETY-121).""" rig.TICK = tick + if seed: + load = (lambda t, h=house(seed): + h(t) + (hw - 800.0 if t >= 300.0 else 0.0)) + else: + load = house(1, step=(300.0, hw)) try: - f = lambda: run(house(1, step=(300.0, hw)), n=2) + f = lambda: run(load, n=2, delay=delay) return f() if fix else no_fix(f) finally: rig.TICK = 1.0 @@ -331,6 +343,10 @@ def per_quarter(c): for q in range(8)] +def every_quarter(c): + return all(n >= 1 for n in per_quarter(c)[1:]) + + _nv = {t: never(t) for t in (2.0, 5.0, 10.0, 15.0)} _nv_old = {t: never(t, fix=False) for t in (2.0, 5.0, 10.0, 15.0)} _nv_r1 = patched(Controller, "_settling", round1)(lambda: never(5.0)) @@ -341,16 +357,9 @@ for _t in _nv: f"{len(notes(_nv_old[_t][1]))}, highest quarter " f"{max(quarters(_nv[_t][1], _t)):.0f} W") print(f" round 1's rule at 5 s: {len(notes(_nv_r1[1]))}") -check("⭐ 2 s and 5 s meters: it warns in every quarter after the first", - all(per_quarter(_nv[t][1])[q] >= 1 for q in range(1, 8) - for t in (2.0, 5.0))) -check("⭐ 10 s meter: it warns in every quarter after the first (round 2 " - "gave none)", - all(per_quarter(_nv[10.0][1])[q] >= 1 for q in range(1, 8))) -check("⭐ 15 s meter: it warns at least every other quarter after the first " - "(round 2 gave none)", - not any(a == 0 and b == 0 for a, b in zip( - per_quarter(_nv[15.0][1])[1:], per_quarter(_nv[15.0][1])[2:]))) +check("⭐ 2, 5, 10 and 15 s meters: it warns in every quarter after the " + "first (round 2 gave none at 10 and 15 s)", + all(every_quarter(_nv[t][1]) for t in _nv)) check("non-vacuous: round 1's rule (a window per hand-back) never warned " "here, and the fix still hides some of what was raised without it", notes(_nv_r1[1]) == [] and all( @@ -363,15 +372,46 @@ check("...and at 5 s the cap held", len(quarters(_nv[5.0][1], 5.0)) == 8 and max(quarters(_nv[5.0][1], 5.0)) < 5000.0) +# SAFETY-121, the rig's shape (TEST-23, F-1): the meter is read in the same +# cycle as the battery, so the guard's charge headroom is right after it +# hands back and the guard and the charge do not chase each other. The loop +# then holds the wire once a quarter, at its start, and is at its bound on +# 1 to 5 cycles (5 s), not 20. House 5100 W +- 30 W (5300 W at 15 s, where +# 5100 W is over the rating in one quarter only, without the fix too). +RIG = {1.0: 5100.0, 2.0: 5100.0, 5.0: 5100.0, 10.0: 5100.0, 15.0: 5300.0} +_rg = {t: never(t, hw, seed=1, delay=0) for t, hw in RIG.items()} +_rg_old = {t: never(t, hw, fix=False, seed=1, delay=0) + for t, hw in RIG.items()} +# SAFETY-119 as merged (bee7431) at 5 s: a settle of 12 cycles, budget 8. +_rg_119 = patched(app_main, "HANDBACK_CYCLES", app_main.SHORT_CYCLES)( + lambda: patched(app_main, "ROLLING_BOUND_CYCLES", 8)( + lambda: never(5.0, 5100.0, seed=1, delay=0))) +for _t in _rg: + print(f" rig shape, {_t:.0f} s meter, house {RIG[_t]:.0f} W: per " + f"quarter {per_quarter(_rg[_t][1])}, without the fix " + f"{per_quarter(_rg_old[_t][1])}, highest quarter " + f"{max(quarters(_rg[_t][1], _t)):.0f} W") +print(f" rig shape, 5 s, SAFETY-119's settle and budget: per quarter " + f"{per_quarter(_rg_119[1])}") +check("⭐ the rig's shape at 1, 2, 5, 10 and 15 s meters: it warns in every " + "quarter after the first, as without the fix", + all(every_quarter(_rg[t][1]) and every_quarter(_rg_old[t][1]) + for t in _rg)) +check("non-vacuous (F-1): with SAFETY-119's settle of 12 cycles and budget " + "of 8, the rig's shape at 5 s warns in at most one quarter", + sum(1 for n in per_quarter(_rg_119[1])[1:] if n) <= 1) +check("...every command the same as without the fix, and the cap held at " + "1 to 10 s", + all(commands(_rg[t][0]) == commands(_rg_old[t][0]) for t in _rg) + and all(max(quarters(_rg[t][1], t)) < 5000.0 + for t in (1.0, 2.0, 5.0, 10.0))) + # The quarter-edge case (part 1) at the slower meters: still no warning. # The meter's own lag limits the cap there, the same with and without the fix. _qe = {} -# Seeds 1 to 3 are the brief's fixed set; 2 s seed 25 is the one where the -# sweep's fixed budget of 8 warned (DECISIONS), kept here so that stays seen. for _t in (2.0, 5.0, 10.0, 15.0): # with part 1: 1, 2, 5, 10, 15 s rig.TICK = _t - for _seed, _dl in ((1, 1), (2, 1), (3, 2)) + ( - ((25, 2),) if _t == 2.0 else ()): + for _seed, _dl in ((1, 1), (2, 1), (3, 2)): _qe[_t, _seed] = (run(house(_seed), delay=_dl), no_fix(lambda: run(house(_seed), delay=_dl))) rig.TICK = 1.0 @@ -379,8 +419,8 @@ for _t in (2.0, 5.0, 10.0, 15.0): # with part 1: 1, 2, 5, 10, 15 s f"{[len(notes(r[0][1])) for k, r in _qe.items() if k[0] == _t]} " f"(without the fix " f"{[len(notes(r[1][1])) for k, r in _qe.items() if k[0] == _t]})") -check("⭐ the quarter-edge case at 2, 5, 10 and 15 s meters, seeds 1 to 3 " - "and (2 s) 25: no notification", +check("⭐ the quarter-edge case at 2, 5, 10 and 15 s meters, seeds 1 to 3: " + "no notification", all(notes(r[0][1]) == [] and r[0][1].clamp_wd.bound == 0 for r in _qe.values())) check("...every command the same as without the fix; without it the false " @@ -388,20 +428,30 @@ check("...every command the same as without the fix; without it the false " all(commands(r[0][0]) == commands(r[1][0]) for r in _qe.values()) and all(any(len(notes(_qe[_t, k][1][1])) >= 1 for k in (1, 2, 3)) for _t in (2.0, 5.0, 10.0, 15.0))) + +# The budget's margins (DECISIONS/SAFETY-121): 9 to 13 met both cases in the +# sweep. 8 warns at the quarter edge (2 s, seed 25); 14 misses quarters in +# the rig's shape (1 s, house 5050 W, seed 1). rig.TICK = 2.0 -_q25_8 = patched(app_main, "ROLLING_BUDGET", ((math.inf, 8),))( - lambda: run(house(25), delay=2)) +_q25 = (run(house(25), delay=2), + patched(app_main, "ROLLING_BOUND_CYCLES", 8)( + lambda: run(house(25), delay=2))) rig.TICK = 1.0 -print(f" 2 s meter, seed 25, a fixed budget of 8: notifications " - f"{notes(_q25_8[1])}") -check("...2 s seed 25 is the sweep's known case: a fixed budget of 8 warns " - "there (why the budget follows the cycle length)", - len(notes(_q25_8[1])) >= 1) -check("the budget is the one the sweep chose. Changing it means re-running " - "the sweep in DECISIONS/SAFETY-119-bound-after-hand-back.md", - app_main.ROLLING_BUDGET == ((3.5, 10), (11.0, 8), (16.0, 6), - (math.inf, 4)) - and app_main.ROLLING_BOUND_CYCLES == 8 and app_main.ROLLING_S == 900.0) +_m14 = patched(app_main, "ROLLING_BOUND_CYCLES", 14)( + lambda: never(1.0, 5050.0, seed=1, delay=0)) +_m11 = never(1.0, 5050.0, seed=1, delay=0) +print(f" 2 s, quarter edge, seed 25: {notes(_q25[0][1])}, budget 8 " + f"{notes(_q25[1][1])}; rig shape 1 s 5050 W per quarter " + f"{per_quarter(_m11[1])}, budget 14 {per_quarter(_m14[1])}") +check("...the budget's margins: 11 is silent at 2 s seed 25 and warns every " + "quarter in the rig's shape at 1 s and 5050 W; 8 warns there, 14 " + "misses a quarter there", + notes(_q25[0][1]) == [] and len(notes(_q25[1][1])) >= 1 + and every_quarter(_m11[1]) and not every_quarter(_m14[1])) +check("the rule is the one the sweep chose. Changing it means re-running " + "the sweep in DECISIONS/SAFETY-121-bound-every-quarter.md", + app_main.HANDBACK_CYCLES == 4 and app_main.ROLLING_BOUND_CYCLES == 11 + and app_main.ROLLING_S == 900.0 and app_main.SHORT_SPAN_S == 22.0) # A start, or a blind cycle, is not a hand-back: the loop at its rail after # 20 s of not running warns at once (R2: a restart counted as a hand-back). @@ -415,19 +465,22 @@ check("⭐ a start after a blind spell is not a hand-back: it warns at the " notes(_bl[1])[:1] and 20.0 <= notes(_bl[1])[0] <= 26.0 and notes(_bl[1]) == notes(_bl_old[1])) -# The budget is cycles, not seconds (R4): at a 5 s meter the loop at its -# rail after a hand-back warns 8 cycles (40 s) later, not 8 s. -MB = 8 # the budget at a 5 s cycle -rig.TICK = 5.0 -_sl = run(house(1, step=(600.0, -6000.0)), dur=900.0, - extra={"peak_cap_w": 20000}) -rig.TICK = 1.0 -_sl1 = [t for t in notes(_sl[1]) if t >= 600.0][:1] -print(f" 5 s meter, hand-back to a loop at its rail at 600 s: first " - f"notification {_sl1}") -check(f"⭐ at a 5 s meter the budget is cycles, not seconds: the first " - f"warning comes {MB} cycles ({MB * 5} s) after the hand-back", - _sl1 and 600.0 + MB * 5.0 <= _sl1[0] <= 600.0 + MB * 5.0 + 10.0) +# One hand-back to a loop at its rail at 600 s: the first warning comes when +# the settle ends, 22 s and 4 cycles after it (SAFETY-119: 12 cycles, 40 s at +# 5 s and 80 s at 10 s). +_sl = {} +for _t in (5.0, 10.0): + rig.TICK = _t + _sl[_t] = run(house(1, step=(600.0, -6000.0)), dur=900.0, + extra={"peak_cap_w": 20000}) + rig.TICK = 1.0 +_sl1 = {t: [x for x in notes(r[1]) if x >= 600.0][:1] for t, r in _sl.items()} +print(f" hand-back to a loop at its rail at 600 s, first notification: " + f"5 s {_sl1[5.0]}, 10 s {_sl1[10.0]}") +check("⭐ one hand-back (the loop has the wire from the cycle after the " + "step): the first warning comes 25 s after it at a 5 s meter (the " + "22 s span), 30 s after it at 10 s (4 cycles)", + _sl1[5.0] == [630.0] and _sl1[10.0] == [640.0]) # ============================================================================ # print("\n5. the rule at its boundaries") @@ -438,7 +491,6 @@ class _C: def __init__(self): self._wire_lost, self._handback, self._hidden = False, None, () - self._settle_t, self._settle_dt = None, None self.loop_clamped = (False, "", False) @@ -451,21 +503,30 @@ def seq(c, steps): return out -N, SPAN = app_main.SHORT_CYCLES, app_main.SHORT_SPAN_S -M, ROLL = 8, 900.0 # the chosen budget, written out on purpose +SPAN = app_main.SHORT_SPAN_S +K, M, ROLL = 4, 11, 900.0 # the chosen rule, written out on purpose _c = _C() check("from the start, owned every cycle: never settling (no hand-back)", seq(_c, [(True, float(i)) for i in range(30)]) == [False] * 30) _c = _C() -_out = seq(_c, [(False, 0.0)] + [(True, 2.0 * i) for i in range(1, N + 3)]) -check(f"after another owner: settling for {N - 1} owned cycles, then not " - f"(12 cycles at 2 s span {SPAN:.0f} s)", - _out == [False] + [True] * (N - 1) + [False] * 3) +_out = seq(_c, [(False, 0.0)] + [(True, 2.0 * i) for i in range(1, 15)]) +check(f"after another owner at 2 s: settling for 11 owned cycles, then not " + f"(the span, {SPAN:.0f} s, decides)", + _out == [False] + [True] * 11 + [False] * 3) _c = _C() _out = seq(_c, [(False, 0.0)] + [(True, 0.5 * i) for i in range(1, 60)]) _end = _out.index(False, 1) if False in _out[1:] else -1 check(f"at a 0.5 s meter the span decides: settling until {SPAN:.0f} s", _end == 1 + int(SPAN / 0.5) and all(_out[1:_end])) +_set = {} +for _tick in (10.0, 30.0, 60.0): + _c = _C() + _set[_tick] = seq(_c, [(False, 0.0)] + + [(True, _tick * i) for i in range(1, K + 2)]) +check(f"at 10, 30 and 60 s the cycles decide: settling for {K - 1} owned " + f"cycles, then not (SAFETY-119: 11)", + all(o == [False] + [True] * (K - 1) + [False] * 2 + for o in _set.values())) _c = _C() _out = seq(_c, [(False, 0.0), (True, 2.0), (True, 4.0), (False, 6.0), (True, 8.0), (True, 10.0)]) @@ -474,12 +535,19 @@ check("losing the wire again restarts the settle", and _c._handback == (8.0, 2)) _c = _C() check("no monotonic clock: the cycle count alone decides", - seq(_c, [(False, None)] + [(True, None)] * (N + 1)) - == [False] + [True] * (N - 1) + [False] * 2) + seq(_c, [(False, None)] + [(True, None)] * (K + 1)) + == [False] + [True] * (K - 1) + [False] * 2) -# The rolling budget: the loop's bound is hidden on at most M cycles in any -# ROLL seconds, across all hand-backs. T = the loop's bound that cycle. -assert M < N - 1, "the budget is meant to run out inside one settle" +# One hand-back, the loop's bound on every cycle: the settle (5 s) or the +# budget (1 s) ends the hiding. +_c = _C() +_o5 = seq(_c, [(False, 0.0)] + [(True, 5.0 * i, True) for i in range(1, 9)]) +_c = _C() +_o1 = seq(_c, [(False, 0.0)] + [(True, 1.0 * i, True) for i in range(1, 21)]) +check("one hand-back, the bound on every cycle: 5 hidden at 5 s (22 s), " + f"then counted; {M} hidden at 1 s (the budget), then counted", + _o5 == [False] + [True] * 5 + [False] * 3 + and _o1 == [False] + [True] * M + [False] * (20 - M)) def turns(c, tick, lost, periods, first=0.0, bound=True): @@ -499,11 +567,8 @@ def turns(c, tick, lost, periods, first=0.0, bound=True): return out, t -_c = _C() -_o = seq(_c, [(False, 0.0)] + [(True, 5.0 * i, True) for i in range(1, N)]) -check(f"one hand-back at 5 s, the bound on every cycle: {M} are hidden, " - f"then it counts for the rest of the settle ({N - 1} cycles)", - _o == [False] + [True] * M + [False] * (N - 1 - M)) +# The rolling budget: the loop's bound is hidden on at most M cycles in any +# ROLL seconds, across all hand-backs. _c = _C() _o, _ = turns(_c, 5.0, 3, 60) _hid = [t for t, h in _o if h] @@ -528,7 +593,7 @@ check(f"the budget refills {ROLL:.0f} s after the oldest hidden cycle: " _a is False and _b is True) _c = _C() _o1, _t = turns(_c, 2.0, 3, 20) -for _ in range(N): # the wire away a whole settle +for _ in range(12): # the wire away a whole settle _c._settling(False, _t) _t += 2.0 _o2, _ = turns(_c, 2.0, 3, 5, first=_t) @@ -539,7 +604,7 @@ check("the budget is not per hand-back or per run: after a whole settle " and not any(h for _t2, h in _o2)) _c = _C() _o1, _t = turns(_c, 2.0, 3, 20) -_ = [_c._settling(True, _t + 2.0 * i) for i in range(N + 1)] +_ = [_c._settling(True, _t + 2.0 * i) for i in range(13)] _c._settling(False, _t + 40.0) _c.loop_clamped = (True, "", False) check("the loop holding the wire a whole settle ends the window: the next " @@ -558,24 +623,20 @@ _c.loop_clamped = (True, "", False) check("an over-rating does not use up the budget", _c._settling(True, _t + 5.0) is True and len(_c._hidden) == 1) -# The budget follows the cycle length: bound cycles hidden before the first -# one counts, one hand-back per turn. +# The budget is one number at every cycle length (SAFETY-119 scaled it). _bud = {} -for _tick in (1.0, 2.0, 3.0, 5.0, 10.0, 15.0, 20.0, 30.0, 60.0): +for _tick in (1.0, 2.0, 3.0, 5.0, 10.0, 15.0, 20.0, 30.0): _c = _C() - _o, _ = turns(_c, _tick, 1, min(14, int(880.0 // (2 * _tick)))) + _o, _ = turns(_c, _tick, 1, 14) _bud[_tick] = sum(1 for _t2, h in _o if h) -print(f" hidden before the first counts, by cycle length: {_bud}") -check("the budget by cycle length: 10 at 1-3 s, 8 at 5-10 s, 6 at 15 s, 4 " - "at 20-60 s", - _bud == {1.0: 10, 2.0: 10, 3.0: 10, 5.0: 8, 10.0: 8, 15.0: 6, - 20.0: 4, 30.0: 4, 60.0: 4}) _c = _C() -_o, _t = turns(_c, 2.0, 3, 8) -_o2, _ = turns(_c, 121.0, 1, 3, first=_t + 119.0) -check("a gap over two minutes is not a cycle length: the 2 s budget (10) " - "stays", - [h for _t2, h in _o + _o2] == [True] * 10 + [False]) +_o60, _ = turns(_c, 60.0, 1, 14) +print(f" hidden before the first counts, one bound cycle per turn: {_bud}; " + f"at 60 s, turns of 2 cycles: {sum(1 for _t2, h in _o60 if h)} of 14 " + "hidden (the budget never runs out: DECISIONS limit)") +check(f"the budget does not follow the cycle length: {M} hidden at 1 to " + "30 s, then counted", + set(_bud.values()) == {M}) # No monotonic clock: the budget cannot refill, so a bound that stays is # counted after the budget however often the wire changes hands. @@ -586,8 +647,8 @@ for _ in range(40): _c._settling(False, None) _c.loop_clamped = (True, "", False) _nc.append(_c._settling(True, None)) -check("no monotonic clock, repeated hand-backs: the budget holds (8 hidden, " - "then every bound counts)", _nc == [True] * M + [False] * (40 - M)) +check(f"no monotonic clock, repeated hand-backs: the budget holds ({M} " + "hidden, then every bound counts)", _nc == [True] * M + [False] * (40 - M)) # An over-rating (a command over `max_w`) is a bug, never settled away. _ctl = _hb[1] @@ -613,13 +674,22 @@ _ctl._loop_alarm_input(_Res()) check("...while the integrator bound on the next cycle is not counted", _ctl.loop_clamped[0] is False) +# A stop ends the window but does not give the budget back (review F2, X3). +_now = _ctl._now_mono +_ctl._hidden = (_now,) * M _ctl._wire_lost, _ctl._handback = True, (1.0, 3) _ctl._loop_decision = None # stopped or blind _ctl._loop_alarm_input(_Res()) -check("a stop clears it: the next start is not a hand-back, and the stop " - "is not a cycle length", - (_ctl._wire_lost, _ctl._handback, _ctl._settle_t) - == (False, None, None)) +_st, _kept = (_ctl._wire_lost, _ctl._handback), _ctl._hidden +_ctl._settling(False, _now + 1.0) +_ctl.loop_clamped = (True, "", False) +_after = _ctl._settling(True, _now + 2.0) +check("a stop clears the window (the next start is not a hand-back) and " + f"keeps the budget: with {M} hidden, the bound after the next " + "hand-back counts", + _st == (False, None) and _kept == (_now,) * M and _after is False) +print(f" after the stop: hidden kept {len(_kept)}, the next hand-back's " + f"bound hidden {_after}") # ============================================================================ # print("\n6. the pinned digests of test_safety84 and test_safety87: only the " diff --git a/goodwe_controller/test_safety84.py b/goodwe_controller/test_safety84.py index e239b37..57ce8a2 100644 --- a/goodwe_controller/test_safety84.py +++ b/goodwe_controller/test_safety84.py @@ -474,20 +474,21 @@ print("\n8. the N=1 and N=2 digests") # pin lifts (t=1800) and B no longer jumps 1390 W, and after the surplus step. # SAFETY-119 re-pinned all six: only the log. OUTPUT_CLAMP rows from the # loop's bound just after the guard hands back are gone; every command and -# claim is the same (test_safety119.py part 6). +# claim is the same (test_safety119.py part 6). SAFETY-121 re-pinned all six +# again: only OUTPUT_CLAMP rows (test_safety119.py part 6). PINNED = { "n1_charge": - "19781f90b9751b10994dedeaafb38e42d48ad2551640792e601336b7f9b5bb4f", + "0ed25c856456b97acb07a39299a8cb7b1a762c4d0005b88a0823c03057a80be5", "n1_charge_dear": - "eeeb0fa19a6fdc04d44a0838bb2bb911f506a936b0f93d8a6f4d87159053ec74", + "c25340b56060d4581f7204e200b07e7c8618711be2baca3b1667b7ebeb600dc3", "n1_charge_banked": - "a51f125a8c1c98fdbb009fce72b6781d20d384bdf0f5ce7bbfe367d86e5477db", + "2619acdd06b04e56c000b168d64e1d044346c6ba3f929c94258d6ad8189ec609", "n2_charge": - "e37e98390baa5dad9128991fabf8b170894395fe026d8a33c8a51de7ed0789cc", + "b16d692128f14bcce3d87b142d290e0d6b13724289680e44a05215c9eaa24a7c", "n2_charge_dear": - "7727372de423f62d77b4426a7226eae31a30f3bb89a3cf70272cc7c1823d7263", + "aa2bbc677a8e2274b25ba1170de1b1635e08a3bd93105e2a38a9bb1575b5b6db", "n2_charge_banked": - "c77e26006c026b953e9c3dcc9a02f3993589f885cb52c7cbceac6bd59b600551", + "a6973faea916e4c88ca1770047f94478346eeb1efa4889b154fad0747f91267f", } _now = s84.digests() for k in PINNED: @@ -495,7 +496,7 @@ for k in PINNED: f"{_now[k][:16]}") check("⭐ at N=1 a charge in and out of a cheap window and under a banked " "month peak is byte-identical to 9d5b7d1 (commands, reasons and every " - "claim; the log as re-pinned by SAFETY-119), and N=2 outside a cheap " + "claim; the log as re-pinned by SAFETY-121), and N=2 outside a cheap " "window matches its SAFETY-85 pin", all(_now[k] == PINNED[k] for k in ("n1_charge", "n1_charge_dear", "n1_charge_banked", diff --git a/goodwe_controller/test_safety87.py b/goodwe_controller/test_safety87.py index 6f0229a..cf7c58c 100644 --- a/goodwe_controller/test_safety87.py +++ b/goodwe_controller/test_safety87.py @@ -521,18 +521,19 @@ print("\n9. N=1 is byte-identical to release/1.0 b8ddfd7") # SAFETY-119 re-pinned n1_crossing, n1_above and n1_charge_low: only the # log. The loop's bound just after a hand-back is not counted, so OUTPUT_CLAMP # rows are gone or count fewer; every command and claim is the same -# (test_safety119.py part 6). +# (test_safety119.py part 6). SAFETY-121 re-pinned the same three again: +# only OUTPUT_CLAMP rows (test_safety119.py part 6). PINNED = { # tools/safety87_identity.py on b8ddfd7 "n1_under": "d2395ef8d74fb23607ad864d5a4bf62c03044bbd9367e873675d7ad10e8c169f", "n1_crossing": - "20f8e542c1ee3eb3a58c8fd6ba3b3e5b6b1486800cd63b675abc68bc222a172b", + "97f7321017d9d34ee17a40dfd4abf73d915f25b9faef086a483d2b5cd124b198", "n1_above": - "3a79f1394b2b49fa88f3c054da1d9da450153ad5f0d2a2c2f960d02a7abe2208", + "9229b0f0e8addd1bd114461cc36c7f02e9734012b3b7e154d7747bd4cc69b773", "n1_under_banked": "a2876c7cc873bc4c974d2b4bd98e23bba2d007b84545587d2fe0b713b0a6249b", "n1_charge_low": - "2e1ee6db0d4f9f18836c4cbbe406fddd496656b54b97f329da513a1591f0ce6c", + "91336e3c0314985a3b00f314c79b5ffb5a740d218de3ad44f88a4db6e4235b32", "n1_hold": "0a1df347754c69166b20d04c15ee878bbcefb02abb824b9b452334f68f03e46d", } @@ -540,7 +541,7 @@ _now = s87.digests() for k in PINNED: print(f" {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'}") check("⭐ every N=1 digest (claims, commands, the guard's decision and the " - "log) equals b8ddfd7's (the log as re-pinned by SAFETY-119), under, " + "log) equals b8ddfd7's (the log as re-pinned by SAFETY-121), under, " "crossing and above the reserve, in a charge and a HOLD, and under a " "banked peak", _now == PINNED)